by Kastro
Paper/Archive/CVE-2026-45140

CVE-2026-45140

chamilo chamilo-lms — Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.0.710 × 2014.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

Affected

ProductAffectedFixed inSource
chamilo-lms< 2.0.1–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4mrefgithub.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844refgithub.com/chamilo/chamilo-lms/releases/tag/v2.0.1