CVE-2026-32931 is an unrestricted file upload vulnerability (CWE-434) in Chamilo LMS affecting versions prior to 1.11.38 and 2.0.0-RC.3. The flaw exists in the exercise sound upload function, where an authenticated teacher can bypass file type restrictions by spoofing the Content-Type header to audio/mpeg while uploading a PHP file. The uploaded file retains its .php extension and is stored in a web-accessible directory, allowing remote code execution as the web server user (www-data). This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. No vendor advisory or patch links are provided in the data, but the description states the issue is fixed in 1.11.38 and 2.0.0-RC.3.

Successful exploitation allows an authenticated teacher to upload a malicious PHP webshell, enabling remote code execution with the privileges of the web server user. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts.

Upgrade Chamilo LMS to version 1.11.38 or later, or 2.0.0-RC.3 or later, where this vulnerability is fixed. Since no official vendor advisory or patch links are provided, verify the upgrade path with the official Chamilo LMS sources before applying. Until upgraded, restrict authenticated user permissions and monitor for suspicious file uploads if possible.