Open-source package vulnerability · Composer (PHP)
CVE-2026-45140: Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
criticalCVSS 3.1 9.8GHSA-g4c3-4g96-6g4m
Impact Ability to run arbitrary code on the server without authentication.
Published Sep 17, 2026
Affected packages
chamilo/chamilo-lms
- Ecosystem
- Composer (PHP)
- Affected
- <= 2.0.0
- Fixed in
- 2.0.1
- Check
composer show chamilo/chamilo-lms
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Ability to run arbitrary code on the server without authentication.
Credited to h4knet.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology