Chamilo LMS CStudio upload flow allows unauthenticated remote code execution (CVE-2026-45140)

Package: chamilo/chamilo-lms
Fixed in: 2.0.1
Published: Thu 17 Sep 2026, 21:23 LisbonUpdated Sun 25 Oct 2026, 23:26 Lisbon

In plain words

An attacker can run arbitrary code on the server without signing in. The advisory identifies the CStudio upload flow in Chamilo LMS as the entry point and affects versions up to and including 2.0.0.

Affected versions

Package	Affected	Fixed in
chamilo/chamilo-lms	<= 2.0.0	2.0.1

Am I affected?

Look for chamilo/chamilo-lms in composer.lock and check its version. Versions up to and including 2.0.0 are affected; 2.0.1 is fixed. The description names no configuration, feature or database condition, so the version is all there is to check.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.1):

composer show chamilo/chamilo-lms | grep versions
composer update chamilo/chamilo-lms

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

Impact

Ability to run arbitrary code on the server without authentication.

Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-94 Improper Control of Generation of Code ('Code Injection'); CWE-219 Storage of File with Sensitive Data Under Web Root; CWE-434 Unrestricted Upload of File with Dangerous Type. Reported by h4knet.

The advisory

GitHub Advisory Database: GHSA-g4c3-4g96-6g4m, with who is affected and how
OSV.dev: GHSA-g4c3-4g96-6g4m
The week's digest, with the other advisories from 14 Sep 2026
All advisories for chamilo/chamilo-lms

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description, affected versions, weakness and credits are from the GitHub Advisory Database (CC BY 4.0). "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.