{"action":"Upgrade chamilo/chamilo-lms to 2.0.1 or later.","affected":[{"fixed":"2.0.1","introduced":"0"}],"component":"chamilo/chamilo-lms","cve_ids":["CVE-2026-45140"],"ecosystem":"Packagist","epss":0.01326,"exploited":false,"fixed_versions":["2.0.1"],"ghsa_id":"GHSA-g4c3-4g96-6g4m","id":"tcs_01M5KF2A2EPWTSJA40R6W717DB","modified_at":"2026-09-17T20:45:05.328230281Z","published_at":"2026-09-17T20:23:39Z","references":["https://osv.dev/vulnerability/GHSA-g4c3-4g96-6g4m","https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g4c3-4g96-6g4m","https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844","https://github.com/chamilo/chamilo-lms","https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-g4c3-4g96-6g4m","url":"https://osv.dev/vulnerability/GHSA-g4c3-4g96-6g4m"}],"summary":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution"}