{"api_version":"1","generated_at":"2026-09-27T13:53:23+00:00","cve":"CVE-2026-45140","urls":{"html":"https://cve.report/CVE-2026-45140","api":"https://cve.report/api/cve/CVE-2026-45140.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-45140","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-45140"},"summary":{"title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution","description":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-09-17 21:17:12","updated_at":"2026-09-24 21:25:27"},"problem_types":["CWE-22","CWE-94","CWE-219","CWE-434","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-94 CWE-94: Improper Control of Generation of Code ('Code Injection')","CWE-219 CWE-219: Storage of File with Sensitive Data Under Web Root","CWE-434 CWE-434: Unrestricted Upload of File with Dangerous Type"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","name":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","name":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","name":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45140","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45140","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"chamilo","product":"chamilo-lms","version":"affected < 2.0.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"45140","cve":"CVE-2026-45140","epss":"0.013260000","percentile":"0.697870000","score_date":"2026-09-25","updated_at":"2026-09-26 00:06:19"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-45140","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-18T17:32:38.016494Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-18T18:33:07.092Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"chamilo-lms","vendor":"chamilo","versions":[{"status":"affected","version":"< 2.0.1"}]}],"descriptions":[{"lang":"en","value":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-219","description":"CWE-219: Storage of File with Sensitive Data Under Web Root","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-434","description":"CWE-434: Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-17T20:11:52.462Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m"},{"name":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844"},{"name":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"}],"source":{"advisory":"GHSA-g4c3-4g96-6g4m","discovery":"UNKNOWN"},"title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-45140","datePublished":"2026-09-17T20:11:52.462Z","dateReserved":"2026-05-08T20:44:38.963Z","dateUpdated":"2026-09-18T18:33:07.092Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 21:17:12","lastModifiedDate":"2026-09-24 21:25:27","problem_types":["CWE-22","CWE-94","CWE-219","CWE-434","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-94 CWE-94: Improper Control of Generation of Code ('Code Injection')","CWE-219 CWE-219: Storage of File with Sensitive Data Under Web Root","CWE-434 CWE-434: Unrestricted Upload of File with Dangerous Type"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-18T17:32:38.016494Z","id":"CVE-2026-45140","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"45140","Ordinal":"1","Title":"Chamilo LMS CStudio upload flow allows unauthenticated remote co","CVE":"CVE-2026-45140","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"45140","Ordinal":"1","NoteData":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.","Type":"Description","Title":"Chamilo LMS CStudio upload flow allows unauthenticated remote co"}]}}}