Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Chamilo LMS lets unauthenticated attackers run code

CVE-2026-45140 · published 27 days ago
Summary

The Chamilo learning management system (versions before 2.0.1) can be accessed by anyone on the internet to run arbitrary commands on the server. This could let an attacker take control of the system or steal data. Upgrade to version 2.0.1 or later to close the risk.

What to do
  • Update chamilo chamilo-lms to version 2.0.1.
  • Update chamilo chamilo/chamilo-lms to version 2.0.1.
Affected software
Ecosystem VendorProductAffected versions
– chamilo chamilo-lms < 2.0.1
composer chamilo chamilo-lms <= 2.0.0
Fix: upgrade to 2.0.1
Packagist chamilo chamilo/chamilo-lms < 2.0.1
Fix: upgrade to 2.0.1
Original advisory text
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-94Code Injection
CWE-219Storage of File with Sensitive Data Under Web Root
CWE-434Unrestricted File Upload
Timeline
Published17 Sep 2026
Updated13 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-45140 · NVD
CVE-2026-45140 · MITRE
GHSA-g4c3-4g96-6g4m · GHSA
CVE-2026-45140 · OSV
GHSA-g4c3-4g96-6g4m · OSV
Track software like this
Free during beta