GitHub Advisoryadvisory · Packagist

GHSA-g4c3-4g96-6g4m Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

CRITICAL Published 2026-09-17 Modified 2026-09-17 Official page ↗
Aliases
CVE-2026-45140
Ecosystem
Packagist
Packages
chamilo/chamilo-lms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-219, CWE-22, CWE-434, CWE-94
Reviewed
2026-09-17

Affected packages

• Packagist chamilo/chamilo-lms: < 2.0.1 → fixed in 2.0.1

Description

Impact Ability to run arbitrary code on the server without authentication.

Related

Alias · CVE (1)

  • CVE-2026-45140 Chamilo LMS is an open-source learning management system. vulnerability

Weakness · CWE (4)

  • CWE-219 Storage of File with Sensitive Data Under Web Root weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-94 Improper Control of Generation of Code weakness

References