CVE-2026-45140— Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Quick assessment
Affected
chamilo chamilo-lms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Chamilo LMS 是一个开源学习管理系统。在 2.0.1 之前，Chamilo LMS 允许未经认证的远程攻击者在服务器上执行任意代码。官方安全公告未明确指出受影响的端点、组件、输入或利用机制。该问题已在 2.0.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45140
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Source: CVE Program / CVE List V5
Vulnerability Description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| chamilo | chamilo-lms | < 2.0.1 | - |
|
II. Public POCs for CVE-2026-45140
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45140
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45140 (1)
Vendor Advisories for CVE-2026-45140 (1)
-
🔗 Unauthenicated RCE v2.0.0 · Advisory · chamilo/chamilo-lms · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-45140 (1)
-
🔗 Release v2.0.1 · chamilo/chamilo-lms · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: chamilo-lms
-
CVE-2026-45143
Chamilo LMS: Student-to-admin stored XSS in private messages -
CVE-2026-82535
Chamilo LMS Stored XSS via Survey Answer Submission in repor -
CVE-2026-34239
Chamilo Authenticated Remote Code Execution -
CVE-2026-39878
Chamilo stored XSS via user registration leads to admin acco -
CVE-2026-40291
Chamilo LMS has Privilege Escalation via API User Role Modif
Same vendor: chamilo
-
CVE-2026-45143
Chamilo LMS: Student-to-admin stored XSS in private messages -
CVE-2026-82535
Chamilo LMS Stored XSS via Survey Answer Submission in repor -
CVE-2026-34239
Chamilo Authenticated Remote Code Execution -
CVE-2026-39878
Chamilo stored XSS via user registration leads to admin acco -
CVE-2026-40291
Chamilo LMS has Privilege Escalation via API User Role Modif
Same weakness: CWE-22
-
CVE-2026-54612
Vvveb: Authenticated editor path traversal to PHP file write -
CVE-2026-54613
Vvveb: Path Traversal in Revision Backup Reader/Deleter via -
CVE-2026-53554
SQLBot: Arbitrary File Write via parseExcel Leading to Code -
CVE-2026-54343
Frappe LMS: Path Traversal in SCORM File Serving -
CVE-2026-54617
GravitLauncher: Unauthenticated path traversal in LaunchServ
V. Comments for CVE-2026-45140
No comments yet