External risk intelligence

Chamilo LMS Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-45140

Chamilo is a Learning Management System (LMS) designed to be accessible to students and faculty, often deployed as a web-based application reachable via the internet to support remote learning and distributed access. Its nature as a public-facing web platform makes it commonly deployed in internet-exposed environments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Chamilo LMS, an open-source learning management system. The flaw, if exploited, could allow an unauthenticated remote attacker to execute arbitrary code on the server, potentially leading to a complete compromise of the system. While the exact impact is not specified, such vulnerabilities in web-facing applications can pose significant risks.

Unauthenticated code execution in learning platform.
Critical flaw could lead to server compromise.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the Chamilo LMS from the internet and trigger arbitrary code execution without needing any credentials. This could lead to a compromise of the server. The specific endpoint, component, input, or exploitation mechanism are not identified in the available information.

Unauthenticated remote access required.
Vulnerable component can be triggered remotely.
Allows arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated remote attacker could execute arbitrary code on the server, potentially impacting the learning management system's functionality and integrity.

Server code execution.
Remote unauthenticated access.
Compromised learning system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Chamilo LMS platform, used for remote learning, is susceptible to unauthenticated remote code execution. Technical leaders, application owners, and infrastructure teams should prioritize identifying all instances of Chamilo LMS, assessing their reachability and business criticality, and confirming ownership to plan remediation.

Identify Chamilo LMS instances.
Verify reachability and criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chamilo LMS?

Chamilo LMS is an open-source web application designed for learning management. Institutions use it to host courses, manage educational content, and facilitate remote interaction between instructors and students. Because it is meant to be accessed by distributed users, it typically runs on web servers that provide the platform's portal to its user base.

What does the code execution vulnerability in CVE-2026-45140 mean?

This vulnerability involves a weakness categorized under several classes, including improper control of file operations and code injection. In plain terms, it means the application fails to properly restrict how it processes data, allowing an attacker to send commands that the server runs as if they were part of the legitimate software. This can grant the attacker full control over the underlying server.

How is this vulnerability triggered by an attacker?

An attacker triggers this flaw by sending specifically crafted network requests to the vulnerable Chamilo LMS server. Importantly, the vulnerability does not require the attacker to have a user account or any prior authorization to succeed. It is not triggered by standard, authorized interactions from students or faculty; it requires specific, malicious input intended to exploit the server's processing logic.

Do I need to worry about this if my Chamilo LMS instance is internal?

Halo Surface Signal indicates that Chamilo LMS is commonly deployed as an internet-facing application to support remote learning, which increases the likelihood of external access. If your instance is strictly internal and restricted from the internet, your immediate risk is lower, though the vulnerability remains a significant security flaw if a user within your network acts maliciously.

What is the first step to remediate CVE-2026-45140?

The primary response is to identify all running instances of Chamilo LMS within your environment and verify their current version. Since this issue is resolved in version 2.0.1, you should prioritize upgrading any systems running software prior to this release. Work with your infrastructure teams to confirm ownership of these instances and coordinate the patch deployment to secure your learning environment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.