CVE-2026-45140: Chamilo LMS Unauthenticated Remote Code Execution

Executive Summary

Chamilo LMS, an open-source learning management system used by schools and training organizations, has patched a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-45140 (CVSS 9.8). The flaw sits in the CStudio plugin's project-import upload flow and lets a remote attacker with no credentials at all execute arbitrary code on the server.

The issue is fixed in Chamilo 2.0.1 (GitHub advisory GHSA-g4c3-4g96-6g4m).

Vulnerability Overview

What's Known

The upstream advisory is unusually sparse on exploitation mechanics — it does not spell out the exact endpoint parameter, input validation gap, or the precise chain from upload to code execution. What is public: the flaw lives in the CStudio plugin's project-import handler, an unauthenticated POST endpoint that accepts uploaded project archives. The CWE tags attached to the advisory (path traversal, code injection, unrestricted file upload, and files with sensitive data landing under the web root) sketch a familiar pattern for this class of bug — an uploaded archive whose contents escape the intended extraction directory, landing an executable file somewhere the web server will run it.

Because the vulnerable endpoint requires no authentication, any deployment running the CStudio plugin without additional network-level restrictions is reachable by anyone who can send it an HTTP request.

Impact

A successful exploit gives an attacker arbitrary code execution on the underlying server — full compromise of the Chamilo instance and, depending on hosting configuration, a foothold into the broader environment. For institutions running Chamilo to host coursework, grades, and student PII, this is a direct path to a large-scale data breach, not just a defacement risk.

Remediation

1. Upgrade to Chamilo 2.0.1 or later immediately — this is an unauthenticated, network-exploitable critical.
2. If immediate patching isn't possible, disable the CStudio plugin or block access to /plugin/CStudio/editor/import-project at the reverse proxy / WAF layer until upgraded.
3. Review server logs for unexpected POST requests to CStudio import endpoints and unfamiliar files written under the web root.
4. Audit outward-facing Chamilo instances — LMS platforms are frequently exposed directly to the internet for student access, which maximizes this bug's reachability.

References

• NVD — CVE-2026-45140
• GitHub Security Advisory GHSA-g4c3-4g96-6g4m
• GitLab Advisory Database — CVE-2026-45140