CVE-2023-3368: Chamilo LMS unauthenticated command injection in additional_webservices.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with CVSS 9.8, a public exploit reference and very high EPSS makes this an urgent patch target.

What it is

Chamilo LMS through v1.11.20 fails to neutralise special characters in /main/webservices/additional_webservices.php, allowing OS command injection. The flaw is a bypass of the earlier CVE-2023-34960 fix, so sites that patched only that issue remain exposed to remote code execution.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the server, leading to full compromise of the LMS host and any data or credentials it holds.

Attack surface

Reachable over the network via HTTP requests to the additional_webservices.php endpoint; no authentication and no user interaction are required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.697, 99.3rd percentile) and a third-party advisory is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Chamilo LMS past v1.11.20 to a release containing the patch commits referenced in the advisory.
• If immediate upgrade is not possible, block or restrict external access to /main/webservices/additional_webservices.php at the web server or WAF.
• Verify the CVE-2023-34960 fix is applied and confirm this bypass is also closed, since patching only the earlier issue is insufficient.
• Run the LMS with least privilege and restrict outbound network access from the web server to limit post-exploitation movement.

Detection

• Inspect web server and application logs for requests to /main/webservices/additional_webservices.php, especially with shell metacharacters or unexpected parameters.
• Monitor for child processes spawned by the web server user (PHP-FPM/Apache) such as sh, bash, curl or wget.
• Alert on outbound connections or file writes originating from the Chamilo web process outside normal application behaviour.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.