Chamilo - Arbitrary File Upload (CVE-2023-4220)

CVE-2023-4220 is a vulnerability in Chamilo LMS related to the big file upload functionality, allowing unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution and stored cross-site scripting attacks.

CrowdSec has been tracking this vulnerability and its exploits since 12th of March 2025.

CrowdSec network observations suggest that most exploitation of CVE-2023-4220 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2023-4220 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed attack attempts are characterized by requests to URLs containing /main/inc/lib/javascript/bigupload/inc/bigupload.php.