CVE-2023-34960: Chamilo wsConvertPpt SOAP command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with an EPSS score above the 99th percentile, makes this an urgent remote code execution risk.

What it is

Chamilo versions 1.11.* up to 1.11.18 contain a command injection flaw in the wsConvertPpt component. A crafted PowerPoint name sent through a SOAP API call is passed to a system command, allowing arbitrary command execution. The vendor rates it critical impact and high risk remote code execution.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the Chamilo server, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network through the SOAP API endpoint that handles PowerPoint conversion. The CVSS vector shows no privileges required and no user interaction, so the call can be made directly by an unauthenticated remote client.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.99325 (99.9th percentile), indicating very high predicted exploitation activity. Public proof-of-concept material is referenced on Packet Storm.

What to do

• Upgrade Chamilo to a version later than 1.11.18 that contains the vendor fix for Issue-112.
• If immediate upgrade is not possible, restrict network access to the SOAP API and the wsConvertPpt endpoint to trusted hosts only.
• Disable or remove the PowerPoint conversion feature if it is not required.
• Apply input validation or sanitization to the PowerPoint name parameter before it reaches any shell command.
• Monitor vendor advisory and security issue tracker for updated guidance.

Detection

• Inspect SOAP API request logs for wsConvertPpt calls containing shell metacharacters or unusual characters in the PowerPoint name parameter.
• Monitor web server and application logs for command execution errors or unexpected child processes spawned by the Chamilo web user.
• Alert on outbound network connections or file writes originating from the Chamilo server process that are not part of normal application behavior.
• Use endpoint detection to flag shell command invocations whose parent process is the Chamilo web server or PHP process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.