CVE-2026-45140

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-22, CWE-94, CWE-219, CWE-434

Description

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

Affected packages

Packagist

chamilo/chamilo-lms

0 → 2.0.1

References

https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m

Status: profiled · ingested 2026-09-19T00:00:27.000Z