{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-45140","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-05-08T20:44:38.963Z","datePublished":"2026-09-17T20:11:52.462Z","dateUpdated":"2026-09-18T18:33:07.092Z"},"containers":{"cna":{"title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution","problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-219","lang":"en","description":"CWE-219: Storage of File with Sensitive Data Under Web Root","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"CWE-434: Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m"},{"name":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844"},{"name":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"}],"affected":[{"vendor":"chamilo","product":"chamilo-lms","versions":[{"version":"< 2.0.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-17T20:11:52.462Z"},"descriptions":[{"lang":"en","value":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1."}],"source":{"advisory":"GHSA-g4c3-4g96-6g4m","discovery":"UNKNOWN"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-18T17:32:38.016494Z","id":"CVE-2026-45140","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T18:33:07.092Z"}}]}}