CVE-2026-45140

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

State: Published
Severity: 9.8 Critical
Published: Sep 17, 2026
Updated: Sep 18, 2026
Reserved: May 8, 2026

Description

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-219 Storage of File with Sensitive Data Under Web Root
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
chamilo-lmschamilo	< 2.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.