CVEvulnerability

CVE-2026-45140

9.8 CRITICAL Published 2026-09-17 Modified 2026-09-24 Official page ↗

Status: Deferred
Published: 2026-09-17
Last modified: 2026-09-24
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-219, CWE-22, CWE-434, CWE-94

Description

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

Weakness · CWE (4)

CWE-219 Storage of File with Sensitive Data Under Web Root weakness
CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
CWE-434 Unrestricted Upload of File with Dangerous Type weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844 github.com
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1 github.com
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m github.com

CVE-2026-45140

Description

Related

Weakness · CWE (4)

References