Unauthenticated RCE Reported in Chamilo LMS via CStudio Upload Flow (CVE-2026-45140)

A GitHub Security Advisory (GHSA-g4c3-4g96-6g4m) discloses a critical vulnerability in Chamilo LMS affecting its CStudio upload flow, tracked as CVE-2026-45140 with a CVSS score of 9.8. Per the advisory, the flaw allows an unauthenticated attacker to run arbitrary code on the server. Chamilo LMS is an open-source learning management system used by educational institutions and organizations to deliver e-learning content. A proof-of-concept is reported as publicly available; no evidence of ransomware or in-the-wild exploitation has been reported at this time.

Why It Matters

An unauthenticated remote code execution vulnerability in a widely deployed LMS platform represents a severe risk: successful exploitation could give an attacker full control of the underlying server, with no login credentials required. Chamilo instances are often internet-facing to support students and staff, which expands the exposed attack surface. Organizations running Chamilo LMS — particularly educational institutions, training providers, and any org hosting a public-facing instance — should treat this as an urgent priority given the maximum-severity CVSS rating and public PoC availability.

What Defenders Should Do Now

• Identify all Chamilo LMS deployments in your environment, including forgotten or legacy instances, and confirm current version against the advisory's fixed release once published.
• Restrict or monitor access to file-upload endpoints associated with the CStudio component, especially from unauthenticated or external sources.
• Watch web server and application logs for anomalous uploads to CStudio-related paths, unexpected file types written to upload directories, or subsequent execution of unusual scripts/processes spawned by the web server user.
• Hunt for post-exploitation indicators such as new web shells, unexpected outbound connections from the application server, or modified files in the Chamilo web root.
• If patching is not immediately possible, consider placing the instance behind a WAF or restricting network exposure until a fix is applied.

Developing Intel

This is a same-day advisory and details may evolve as the vendor and community respond. Patch availability and further technical detail should be confirmed directly from the source advisory: GHSA-g4c3-4g96-6g4m.