CVE-2026-45140

CRITICALCVSS 9.8

Description

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

Timeline

Published:September 17th, 2026 9:17 PM

Last modified:September 24th, 2026 9:25 PM

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22 CWE-94 CWE-219 CWE-434

References & Reports

Advisories, patches, and third-party reports

https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m

Source: NIST NVD · Data may lag official sources by up to one minute