{"id":"CVE-2026-45140","state":"PUBLISHED","title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution","description":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.","publishedAt":"2026-09-17T20:11:52.462Z","updatedAt":"2026-09-18T18:33:07.092Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["chamilo chamilo-lms"],"affected":[{"vendor":"chamilo","product":"chamilo-lms","versions":[{"version":"< 2.0.1","status":"affected"}]}],"references":["https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"],"weaknesses":["CWE-22","CWE-94","CWE-219","CWE-434"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/45xxx/CVE-2026-45140.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-45140","state":"PUBLISHED","datePublished":"2026-09-17T20:11:52.462Z","dateUpdated":"2026-09-18T18:33:07.092Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-05-08T20:44:38.963Z"},"containers":{"cna":{"title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution","descriptions":[{"lang":"en","value":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1."}],"affected":[{"vendor":"chamilo","product":"chamilo-lms","versions":[{"version":"< 2.0.1","status":"affected"}]}],"references":[{"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","name":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","name":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","tags":["x_refsource_MISC"]},{"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","name":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-219","lang":"en","description":"CWE-219: Storage of File with Sensitive Data Under Web Root","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"CWE-434: Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-09-17T20:11:52.462Z"},"source":{"advisory":"GHSA-g4c3-4g96-6g4m","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-18T17:32:38.016494Z","id":"CVE-2026-45140","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-18T18:33:07.092Z"}}]}}}