Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-45140Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Critical 9.8
In plain English
A critical-severity path traversal in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | chamilo/chamilo-lms | 2.0.1 | GHSA-g4c3-4g96-6g4m |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chamilo | chamilo-lms | < 2.0.1 |
Weakness: CWE-22, CWE-94, CWE-219, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H