CVE-2026-45140: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in chamilo chamilo-lms
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
AI Analysis
Technical Summary
CVE-2026-45140 is a critical vulnerability in Chamilo LMS, an open-source learning management system. The flaw involves improper limitation of a pathname to a restricted directory (CWE-22), enabling unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability affects all versions prior to 2.0.1 and is resolved in version 2.0.1. The authoritative advisory does not provide details on the specific vulnerable endpoint, input vector, or exploitation method. The CVSS 3.1 base score is 9.8, reflecting high impact and ease of exploitation.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system. This can result in complete takeover of the Chamilo LMS instance and potentially the underlying server environment.
Mitigation Recommendations
Upgrade Chamilo LMS to version 2.0.1 or later to remediate this vulnerability. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 2.0.1.
CVE-2026-45140: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in chamilo chamilo-lms
Description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
CVSS v3.1
Score 9.8critical
Affected software
chamilo
chamilo-lms
pkg:github/chamilo/chamilo-lmsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-45140 is a critical vulnerability in Chamilo LMS, an open-source learning management system. The flaw involves improper limitation of a pathname to a restricted directory (CWE-22), enabling unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability affects all versions prior to 2.0.1 and is resolved in version 2.0.1. The authoritative advisory does not provide details on the specific vulnerable endpoint, input vector, or exploitation method. The CVSS 3.1 base score is 9.8, reflecting high impact and ease of exploitation.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system. This can result in complete takeover of the Chamilo LMS instance and potentially the underlying server environment.
Mitigation Recommendations
Upgrade Chamilo LMS to version 2.0.1 or later to remediate this vulnerability. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 2.0.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-08T20:44:38.963Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac51e955bf5e2cf5e0db7e
Added to database: 09/17/2026, 20:47:37 UTC
Last enriched: 09/17/2026, 21:01:49 UTC
Last updated: 09/18/2026, 03:03:36 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.