Chamilo LMS: Unauthenticated Remote Code Execution Vulnerability (CVE-2026-45140)

What happened

A vulnerability in Chamilo LMS was publicly disclosed that allows an unauthenticated remote attacker to execute arbitrary code on the server running the affected software. The title published alongside the advisory references the 'CStudio upload flow,' but the authoritative advisory text itself does not specify the affected endpoint, component, input, or exploitation mechanism in detail.

Technical cause

The vulnerability is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). This class of vulnerability typically allows an attacker to manipulate file paths to access or write files outside of an intended directory. In this case, the authoritative advisory does not provide further detail on the specific code path, parameter, or mechanism involved, so the exact exploitation technique cannot be confirmed from the available facts.

Why it matters

This vulnerability can be exploited by an unauthenticated attacker over the network, with no user interaction required, to achieve remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates low attack complexity and high impact to confidentiality, integrity, and availability. Successful exploitation could allow full compromise of the server hosting Chamilo LMS, including access to or modification of stored data.

Affected versions

Chamilo LMS versions from 0 up to and including 2.0.0 are affected, as reported by two independent advisory sources. Version 2.0.1 resolves this issue.

Fixes and mitigation

The vendor has released version 2.0.1 of Chamilo LMS, which fixes this vulnerability. No alternative mitigations are described in the available facts.

Recommended action

Site owners and administrators running Chamilo LMS version 2.0.0 or earlier should update to version 2.0.1 as soon as possible. Given the unauthenticated and remote nature of this vulnerability, treat this update as high priority.