CVE-2026-45140: 
PHP vulnerability analysis and mitigation

CVE-2026-45140 is a critical unauthenticated remote code execution (RCE) vulnerability in Chamilo LMS, an open-source learning management system. The flaw resides in the CStudio plugin's file upload flow and allows a remote, unauthenticated attacker to execute arbitrary code on the server. It affects Chamilo LMS version 2.0.0 and was fixed in version 2.0.1. The vulnerability was originally published on June 9, 2026, and added to the GitHub Advisory Database on September 17, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Chamilo Advisory).

The vulnerability is rooted in multiple weaknesses within the CStudio plugin's big-upload.php endpoint: unrestricted file upload (CWE-434), path traversal (CWE-22), code injection (CWE-94), and storage of sensitive files under the web root (CWE-219). Prior to the patch, the endpoint at public/plugin/CStudio/editor/import-project/inc/big-upload.php accepted file uploads without requiring an authenticated Chamilo session, and the final filename used during the finish action was taken directly from attacker-controlled POST data ($_POST['name']) without sanitization. This allowed an attacker to upload a malicious file (e.g., a PHP web shell) with a crafted filename and path traversal sequences, placing it in a web-accessible directory where it could subsequently be executed. The patch added session-based authentication checks, filename sanitization via disable_dangerous_file() and api_replace_dangerous_char(), and session-locked filename registration to prevent attacker-controlled final filenames (Github Advisory, Patch Commit).

Successful exploitation grants an unauthenticated remote attacker full arbitrary code execution on the server, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read, modify, or delete any data accessible to the web server process — including course content, user credentials, and personal data of students and instructors. The ability to deploy a persistent web shell also enables lateral movement within the hosting environment and potential use of the compromised server as a pivot point for further attacks (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.085% (25th percentile), indicating a currently low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by security researcher h4knet (Github Advisory).

1. Reconnaissance: Identify internet-facing Chamilo LMS instances running version 2.0.0 using search engines (e.g., Shodan, Censys) or by fingerprinting the application via its login page or version disclosure.
2. Locate the vulnerable endpoint: Target the unauthenticated file upload endpoint at public/plugin/CStudio/editor/import-project/inc/big-upload.php, which in version 2.0.0 does not require a valid Chamilo session.
3. Upload malicious file: Send a multipart HTTP POST request to the endpoint with ?action=upload and a crafted bigUploadFile parameter containing a PHP web shell (e.g., <?php system($_GET['cmd']); ?>), using a filename with a .php extension.
4. Control final filename via path traversal: During the finish action, supply a crafted name POST parameter (e.g., ../../webshell.php) to place the uploaded file in a web-accessible directory, bypassing any intended upload directory restrictions.
5. Execute arbitrary code: Access the uploaded web shell via its URL (e.g., https://target/path/to/webshell.php?cmd=id) to execute arbitrary OS commands as the web server user, enabling data exfiltration, persistence, or lateral movement (Github Advisory, Patch Commit).

• Network: Unexpected HTTP POST requests to public/plugin/CStudio/editor/import-project/inc/big-upload.php from unauthenticated (no session cookie) sources; outbound connections from the web server to unknown external IPs following upload activity.
• File System: Presence of .php files in CStudio upload directories or parent directories outside the intended upload path; files with web shell signatures (e.g., system(), exec(), passthru(), base64_decode()) in web-accessible locations.
• Logs: Web server access logs showing POST requests to big-upload.php?action=upload or big-upload.php?action=finish without a valid session cookie; subsequent GET requests to newly created .php files with command parameters (e.g., ?cmd=).
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget, python) following file upload activity.

Upgrade Chamilo LMS to version 2.0.1, which sanitizes file upload inputs, enforces session-based authentication on the CStudio upload endpoint, and uses session-locked filename registration to prevent attacker-controlled final filenames. If immediate upgrade is not possible, consider disabling or restricting access to the CStudio plugin endpoint (public/plugin/CStudio/editor/import-project/inc/big-upload.php) via web server configuration (e.g., deny access in Apache/Nginx). Additionally, ensure the web server user has minimal filesystem permissions to limit the impact of any successful exploitation (Chamilo Release, Patch Commit).

The vulnerability was reported by security researcher h4knet and disclosed by Chamilo maintainer ywarnier via a GitHub Security Advisory. A Mastodon post referencing the CVE was observed shortly after publication, indicating early community awareness. No major vendor statements, dedicated blog posts, or significant media coverage beyond automated vulnerability tracking sites (VulnDB, OSV, ionix.io) have been identified as of the advisory date (Github Advisory).