Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

CRITICAL 9.8CVE-2026-45140 · GHSA-g4c3-4g96-6g4m · Published 17/09/2026 · updated 24/09/2026

Package	Affected versions	Patched versions
chamilo/chamilo-lms Packagist	`< 2.0.1`	`2.0.1`

Description

Impact

Ability to run arbitrary code on the server without authentication.

NVD description

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

References

chamilo/chamilo-lms security advisory · WEB
chamilo/chamilo-lms commit 4bdba1b · WEB
chamilo/chamilo-lms · PACKAGE
chamilo/chamilo-lms release v2.0.1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free