CVE-2026-45140

Executive Summary

CVE-2026-45140 is a critical, unauthenticated remote code execution (RCE) vulnerability in Chamilo LMS, an open-source learning management system. Per the NVD description, any remote attacker with network access can execute arbitrary code on an affected server without authentication, and the issue is fixed in version 2.0.1. Organizations running Chamilo LMS versions prior to 2.0.1 — particularly internet-exposed deployments used by educational institutions — face complete server compromise risk, with CVSS 9.8 (C:H/I:H/A:H) and classification as CWE-22 (Path Traversal).

Technical Analysis

The authoritative NVD text states three definitive facts: (1) the product is Chamilo LMS; (2) affected versions are those prior to 2.0.1; (3) the impact is unauthenticated remote arbitrary code execution. Critically, the description explicitly notes that the authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This analysis therefore constrains itself to what is derivable and does not fabricate endpoints, parameters, or code paths.

The CWE assigned is CWE-22: "Improper Limitation of a Pathname to a Restricted Directory" (Path Traversal). Combined with the stated RCE impact, the most defensible inference is the classic path-traversal-to-code-execution pattern: attacker-controlled path input is not properly canonicalized or restricted, allowing a specially constructed path to escape an intended base directory. In web applications, three high-level mechanisms commonly convert uncontrolled path handling into code execution:

1. Arbitrary File Write via traversal — a path parameter that becomes a filesystem write target, permitting an attacker to drop a file (e.g., a script or configuration artifact) outside the intended directory and then request it for execution. This is the canonical "path traversal → RCE" chain and is the most consistent with CWE-22 plus full C:H/I:H/A:H.
2. Local File Inclusion via traversal — traversal in a file-selection routine that causes inclusion/interpretation of an unintended file, which under certain configurations yields code execution.
3. Archive extraction (Zip Slip-style) or upload path escape — traversal within entry names or upload paths writing attacker content to executable locations.

Which specific mechanism applies to CVE-2026-45140 cannot be determined from the provided data. The NVD entry does not name the affected route, module, parameter, or file path, and no CNA title, PoC, or Nuclei template is available. Chamilo is a large PHP application with many historical path-handling and file-management surfaces, but naming any concrete script or parameter here would be invention. Analysts should treat the mapping from "path traversal" to the specific write/include sink as unconfirmed pending the vendor advisory.

The attack surface is the full authenticated and unauthenticated HTTP(S) interface of the LMS. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the vulnerable code path is reachable without credentials (PR:N) and without user interaction (UI:N) over the network (AV:N), at low attack complexity (AC:L) — i.e., no special preconditions, no race conditions, no victim clicks. That combination on an internet-facing CMS/LMS strongly implies a directly requestable endpoint.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available (PoC_STATUS: None). The following attack chain is described at the vulnerability-class level only; because the authoritative advisory identifies no endpoint, component, input, or mechanism, no specific URLs, parameters, or payload strings can be provided without fabrication.

1. Reconnaissance / target identification. An attacker identifies internet-exposed Chamilo LMS instances — via banner/title fingerprinting (e.g., HTTP titles and page content containing "Chamilo") and version disclosure in responses or the login page. Targets are filtered to versions prior to 2.0.1. Shodan-style queries shown in METADATA support this step.
2. Triggering the flaw class. The attacker sends a crafted HTTP request to an unauthenticated-reachable code path that performs path handling over a restricted base directory. Per CWE-22, the request supplies path input (e.g., a traversal sequence intended to escape the intended directory) that the application fails to properly limit or canonicalize. Because PR:N/UI:N/AC:L, this requires only a single crafted request — no authentication and no user interaction. The precise parameter and endpoint are not identified in available data.
3. Execution. Based on the CWE-22 + RCE combination, the outcome is that the traversal enables either (a) writing attacker-controlled content to a location the attacker can cause the server to execute, or (b) causing the server to include/interpret an unintended file. The exact payload/execution method depends on which mechanism applies and cannot be confirmed from available sources.
4. Post-exploitation impact. With arbitrary code execution in the web server context, an attacker achieves full compromise of confidentiality, integrity, and availability (matching C:H/I:H/A:H): exfiltration of the LMS database and user data, credential theft, webshell persistence, lateral movement to adjacent systems, and service disruption. Boot-to-root and data-integrity manipulation within the LMS are both in scope.

Note: The mapping of the generic path-traversal→RCE chain to CVE-2026-45140's specific sink is inferred from the CWE and CVSS data; it is not documented in the supplied advisory.

Impact Assessment

CVSS 3.1: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Subscore interpretation:

• AV:N — Exploitable across the network; any exposure to untrusted networks (including the public internet) is sufficient.
• AC:L — No specialized conditions; reliably achievable.
• PR:N — No privileges required; unauthenticated attackers qualify.
• UI:N — No victim interaction required.
• S:U — Impact is scoped to the vulnerable Chamilo component.
• C:H / I:H / A:H — Total loss of confidentiality, integrity, and availability on the affected component.

Business impact. LMS platforms hold student and staff PII (FERPA/GDPR-relevant), authentication data, assessment records, and often integrate with SSO, email, and institutional identity systems. Full RCE on this component means database and file exfiltration, tampering with grades/records, credential harvest for lateral movement, and use of the host as a beachhead inside the educational/institutional network. Because exploitation is unauthenticated, timing is attacker-controlled and pre-auth mass-scanning is trivial.

Blast radius. Internet-exposed Chamilo instances < 2.0.1 are at direct risk. Internal-only deployments remain at risk from any position with network reachability plus any SSRF/pivot vector. CISA KEV status: NO — no confirmed in-the-wild exploitation as of the data snapshot. EPSS: not yet scored by FIRST.org — no probabilistic exploitation estimate is available; do not assume low likelihood solely from its absence.

Detection Guidance

Detection is complicated by the absence of a published endpoint, parameter, or PoC. Rules below target (a) generic path-traversal patterns and (b) the post-exploitation arbitrary-file-write/RCE behaviors that are the expected consequences of a CWE-22 RCE. Rules should be tuned to the Chamilo-specific endpoint once the vendor advisory is clarified.

Sigma Rule

title: Chamilo LMS CVE-2026-45140 Path Traversal to RCE Attempt
id: 8f3a2c1e-4514-40b1-9c2a-chamilo45140
status: experimental
description: Detects HTTP requests containing path-traversal sequences against Chamilo LMS, consistent with CWE-22 exploitation attempts against pre-2.0.1 versions (CVE-2026-45140).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45140
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '....//'
  selection_app:
    cs-uri-stem|contains: 'chamilo'
  condition: selection_method and selection_path and selection_app
falsepositives:
  - Legitimate file-management operations within Chamilo
  - Security scanners and authorized penetration tests
level: high

YARA Rule

rule CVE_2026_45140_Chamilo_Traversal_RCE
{
    meta:
        description = "Detects Chamilo LMS pre-2.0.1 path traversal / RCE artifacts (CVE-2026-45140)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45140"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $trav1 = "../" ascii nocase
        $trav2 = "..\\" ascii nocase
        $trav3 = "%2e%2e%2f" ascii nocase
        $trav4 = "..%2f" ascii nocase

    condition:
        filesize < 10MB and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-45140 Chamilo LMS Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET" or content:"POST"; http.uri; content:"chamilo"; nocase; http.uri; pcre:"/(\.\.\/|\.\.%2f|%2e%2e%2f|\.\.%5c)/i"; classtype:web-application-attack; reference:cve,2026-45140; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-45140; sid:900451401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("GET","POST") and
     http.request.uri : "*chamilo*" and
     http.request.uri : ("*../*" or "*..%2f*" or "*%2e%2e*" or "*..%5c*")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri=lower(uri)
| where (match(uri, "(\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c|\.\./)"))
| where match(uri, "chamilo")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(clientip) as src_ips by clientip
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,chamilo,cve-2026-45140,">
  <rule id="100514" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c</url>
    <description>CVE-2026-45140: Chamilo LMS path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Although the NVD description states the issue is fixed in Chamilo LMS 2.0.1, no vendor patch reference, commit hash, or package advisory is available in the supplied data. Verify independently against the vendor release before relying on an upgrade.

1. Immediate mitigations.
   • Remove internet exposure: place Chamilo behind authentication-gating reverse proxy/VPN where feasible.
   • Apply a WAF rule set blocking traversal sequences (../, encoded variants) to Chamilo URIs; deploy the Suricata/Sigma/Wazuh rules above.
   • Enforce strict filesystem permissions so the web-server user cannot write to executable or web-served directories.
   • Restrict outbound egress from the Chamilo host to limit post-exploitation movement.
2. Patch / upgrade steps.
   • Upgrade to Chamilo LMS 2.0.1 or later (per NVD).
   • Back up the database and application files before upgrading; validate the release signature only after confirming the official source, since no tracked patch evidence exists.
   • After upgrading, re-scan to confirm version and re-test that the traversal vector is closed.
3. Long-term hardening.
   • Maintain an asset inventory and version tracking for all exposed LMS instances; monitor vendor advisories continuously.
   • Implement input canonicalization and allow-listing for all file/path parameters application-wide.
   • Run the LMS with least privilege and isolate it from sensitive internal networks (segmentation).
   • Continuously hunt for webshells and anomalous file writes (file-integrity monitoring).
   • Establish pre-auth scanning detections (the rules above) as standing SOC coverage.

References

1. NVD — CVE-2026-45140: https://nvd.nist.gov/vuln/detail/CVE-2026-45140
2. MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Chamilo LMS project site / release notes (verify the 2.0.1 security release): https://chamilo.org/
5. FIRST EPSS (CVE not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-45140

Exploit-in-the-wild / threat actor evidence: None available. CISA KEV: NO. No PoC, exploit code, or Nuclei template identified. No campaign attribution is supported by the supplied data; do not attribute.