CVE-2024-47886

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-478876.6Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.CVE-2024-478886.6Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.CVE-2024-478896.6Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, CVE-2024-47896.4Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_dem CVE-2024-478917.8Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2024-478927.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-478936.5Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside th CVE-2024-478947.1Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virt CVE-2024-478957.1Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virt CVE-2024-478963.3Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's vi CVE-2024-478978.8Software installed and run as a non-privileged user may conduct improper GPU system calls resulting in platform instability and reboots.CVE-2024-478987.8Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.