CVE-2026-45140

Summary

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

Affected Software

VendorProductVersion RangeStatus
chamilochamilo-lms< 2.0.1affected

Weaknesses

  • CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-94: CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-219: CWE-219: Storage of File with Sensitive Data Under Web Root
  • CWE-434: CWE-434: Unrestricted Upload of File with Dangerous Type

References