Chamilo LMS CStudio Unauthenticated Remote Code Execution

Chamilo LMS versions 2.0.0 and earlier are vulnerable to an unauthenticated remote code execution (RCE) flaw in the CStudio file upload component. The vulnerability, tracked as CVE-2026-45140, stems from a combination of path traversal (CWE-22) and unrestricted file upload (CWE-434) issues. Attackers can leverage the upload flow to store malicious files within the web document root, which can subsequently be executed by the server. This allows for total compromise of the application and potentially the underlying server infrastructure. Given the lack of required privileges and user interaction, this vulnerability represents a critical risk for deployments of Chamilo LMS. Users are strongly advised to upgrade to version 2.0.1 or later to remediate the flaw.

Impact

Successful exploitation leads to full server compromise, allowing unauthenticated attackers to execute arbitrary code, modify application data, and access sensitive files. The vulnerability affects all Chamilo LMS instances running version 2.0.0 or older. Given the high CVSS score of 9.8, the potential for data exfiltration and complete system takeover is high for affected organizations in the education and corporate learning sectors.

Recommendation

• Upgrade all Chamilo LMS installations to version 2.0.1 or later immediately to patch CVE-2026-45140.
• Audit webserver access logs for POST requests to the CStudio upload endpoint followed by direct requests to unusual files in the application's upload directory.
• Implement strict ingress filtering for web traffic to the application to minimize exposure to unauthenticated exploitation attempts.
• Review file system permissions on the web root to ensure that user-uploaded content directories do not have execution privileges.