CVE-2026-34239 affects Chamilo LMS versions up to 1.11.40. The vulnerability exists in the lang.ajax.php script, which is protected only by api_protect_course_script(true), permitting any authenticated course participant to execute remote code. This improper authorization flaw allows authenticated users with course enrollment to exploit the endpoint, potentially leading to remote code execution within the application context. No official patch or remediation guidance is currently available from the vendor.

An authenticated user enrolled in any course can exploit this vulnerability to execute remote code on the affected Chamilo LMS server. This could lead to unauthorized actions within the system, potentially compromising the integrity and confidentiality of the LMS environment. The vulnerability requires high privileges (authenticated user with course enrollment) but does not require user interaction beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint by limiting authenticated user permissions or applying network-level controls to reduce exposure. Monitor for updates from the Chamilo project regarding patches or official mitigations.