CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
CVE-2026-45140 is a critical vulnerability (CVSS 9.8) in Chamilo Chamilo-lms, published September 17, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in chamilo/chamilo-lms 2.0.1.
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
- Record
CVE-2026-45140- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-94, CWE-219, CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2026-82420
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
- Record
EUVD-2026-82420- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g4c3-4g96-6g4m
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Impact
Ability to run arbitrary code on the server without authentication.
- Record
GHSA-g4c3-4g96-6g4m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-94, CWE-219, CWE-434
- Updated
- 2026-11-02
NVD
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
- Record
CVE-2026-45140- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-94, CWE-219, CWE-434
- Updated
- 2026-11-02
OSV
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
- Record
CVE-2026-45140- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-219, CWE-22, CWE-434, CWE-94
- Updated
- 2026-11-02
OSVGHSA-g4c3-4g96-6g4m
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Impact
Ability to run arbitrary code on the server without authentication.
- Record
GHSA-g4c3-4g96-6g4m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-219, CWE-22, CWE-434, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chamilo/chamilo-lmsPackagist |
through 2.0.0 | 2.0.1 |
chamilo/chamilo-lmsPackagist |
before 2.0.1 | 2.0.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | abraxas/CVE-2026-45140 | 2026-09-18 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m
nvd.nist.gov/vuln/detail/CVE-2026-45140