Résumé
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Détails de l’avis
Impact
Ability to run arbitrary code on the server without authentication.
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-105677
Ghost: Remote Code Execution via Theme Translation Files
- HIGHCVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
- HIGHCVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
- MEDIUMCVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
- HIGHCVE-2026-102870
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability