CVE-2026-45140

critical · 9.8

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.

9.8

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-09-17

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22CWE-94CWE-219CWE-434

References

https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-45140