Is CVE-2026-32892 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-32892, but active exploitation has not been confirmed.

Can CVE-2026-32892 be exploited remotely?

Yes. CVE-2026-32892 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32892?

CVE-2026-32892 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-32892

CRITICALPOC

CVE-2026-32892

CWE-78Published: April 10, 2026· Updated: Apr 13, 2026

9.1

CVSS v3.1

Official Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter — which only passes through Security::remove_XSS() (an HTML-only filter) — is concatenated directly into shell commands such as exec("mv $source $target"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

NVD Source

Technical Analysis

CVE-2026-32892 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.1.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

A proof-of-concept (PoC) exploit exists for CVE-2026-32892. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.