CVE-2026-33698 affects Chamilo LMS portals that still have the main/install/ directory present and readable. A chained attack can let an unauthenticated attacker modify or create files. NVD scores it 9.8. Upgrade to 1.11.38 and delete the install directory.
What's affected
The advisory title says the issue affects Chamilo 1.11.36 and below, and lists 1.11.38 as the patched version. The NVD record says versions prior to 1.11.38. Only portals where main/install/ is still present and read accessible are in scope, and file changes are limited to what system permissions allow.
How to check if you're exposed
Check whether the directory exists on your web server:
ls -d /path/to/chamilo/main/install
If it exists and your web server can serve it, you are exposed on an affected version. Check your Chamilo version in the administration panel or in the code tree, and compare it with 1.11.38.
The advisory also lists signs of compromise. Look at the modification time of app/config/configuration.php and its contents, especially calls that write files, changes to the database host and credentials, or changes to the security key setting.
What to do now
- Delete
main/install/. The advisory says this is not required for working systems and is a workaround on its own. - Update to Chamilo 1.11.38 or later, or apply the commit the advisory references.
- Inspect
app/config/configuration.phpfor unexpected function calls, new database settings or a changed security key. - If you find changes, treat the portal as compromised: rotate database credentials and the security key, and restore from a clean backup.
Why it matters
The record uses CWE-552, files or directories accessible to external parties. Installers exist to run once. When one stays on a live server, it keeps code paths meant for a trusted setup moment that anyone can now reach.
The lesson is operational as much as code. Remove setup tooling after install, and make deployment steps do it for you. The record is not marked as exploited in the wild and is not in CISA KEV.
Quick check
Is deleting the install folder enough?
The advisory lists it as a workaround, but you should still update to 1.11.38 or later.
Sources
Last reviewed: 19 October 2026.
