{"schema_version":1,"title":"Chamilo Lms vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 34 vulnerabilities in Chamilo Lms: 0 in the last 7 days and 3 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-45140, was published on 17 September 2026.","url":"https://junglewise.ai/threats/technologies/chamilo-lms","json_url":"https://junglewise.ai/threats/technologies/chamilo-lms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/chamilo-lms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":17,"all_time":34,"critical":5,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":3,"last_365_days":34},"latest":[{"cve":"CVE-2026-45140","cvss":9.8,"epss":0.0133,"slug":"cve-2026-45140-chamilo-lms-cstudio-upload-flow-unauthenticated-remote-code","title":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute a","severity":"critical","exploited":false,"published_at":"2026-09-17T21:17:12.44+00:00","url":"https://junglewise.ai/threats/cve-2026-45140-chamilo-lms-cstudio-upload-flow-unauthenticated-remote-code"},{"cve":"CVE-2026-39878","cvss":9.3,"slug":"cve-2026-39878-chamilo-lms-stored-xss-in-user-registration-form","title":"Chamilo LMS stored XSS in user registration form","severity":"critical","exploited":false,"published_at":"2026-07-20T18:16:51.713+00:00","url":"https://junglewise.ai/threats/cve-2026-39878-chamilo-lms-stored-xss-in-user-registration-form"},{"cve":"CVE-2026-34239","cvss":7.5,"slug":"cve-2026-34239-chamilo-lms-remote-code-execution-in-lang-ajax-php","title":"Chamilo LMS remote code execution in lang.ajax.php","severity":"info","exploited":false,"published_at":"2026-07-20T18:16:51.36+00:00","url":"https://junglewise.ai/threats/cve-2026-34239-chamilo-lms-remote-code-execution-in-lang-ajax-php"},{"cve":"CVE-2026-40291","cvss":8.8,"epss":0.0032,"slug":"cve-2026-40291-chamilo-lms-privilege-escalation-in-api-user-role-modification","title":"Chamilo LMS privilege escalation in API user role modification","severity":"high","exploited":false,"published_at":"2026-04-14T22:16:32.507+00:00","url":"https://junglewise.ai/threats/cve-2026-40291-chamilo-lms-privilege-escalation-in-api-user-role-modification"},{"cve":"CVE-2026-35196","cvss":8.8,"epss":0.0176,"slug":"cve-2026-35196-chamilo-lms-os-command-injection-in-gradebook-certificate-export","title":"Chamilo LMS OS command injection in gradebook certificate export","severity":"high","exploited":false,"published_at":"2026-04-14T22:16:31.993+00:00","url":"https://junglewise.ai/threats/cve-2026-35196-chamilo-lms-os-command-injection-in-gradebook-certificate-export"},{"cve":"CVE-2026-34602","cvss":7.1,"epss":0.002,"slug":"cve-2026-34602-chamilo-lms-idor-in-course-enrollment-api","title":"Chamilo LMS IDOR in course enrollment API","severity":"high","exploited":false,"published_at":"2026-04-14T22:16:31.5+00:00","url":"https://junglewise.ai/threats/cve-2026-34602-chamilo-lms-idor-in-course-enrollment-api"},{"cve":"CVE-2026-34370","cvss":6.5,"epss":0.0023,"slug":"cve-2026-34370-chamilo-lms-idor-in-notebook-module","title":"Chamilo LMS IDOR in notebook module","severity":"medium","exploited":false,"published_at":"2026-04-14T22:16:31.34+00:00","url":"https://junglewise.ai/threats/cve-2026-34370-chamilo-lms-idor-in-notebook-module"},{"cve":"CVE-2026-34161","cvss":5.4,"epss":0.0022,"slug":"cve-2026-34161-chamilo-lms-stored-xss-in-social-post-attachments","title":"Chamilo LMS Stored XSS in social post attachments","severity":"medium","exploited":false,"published_at":"2026-04-14T21:16:26.4+00:00","url":"https://junglewise.ai/threats/cve-2026-34161-chamilo-lms-stored-xss-in-social-post-attachments"},{"cve":"CVE-2026-34160","cvss":8.6,"epss":0.0034,"slug":"cve-2026-34160-chamilo-lms-unauthenticated-ssrf-in-pens-plugin","title":"Chamilo LMS unauthenticated SSRF in PENS plugin","severity":"high","exploited":false,"published_at":"2026-04-14T21:16:26.227+00:00","url":"https://junglewise.ai/threats/cve-2026-34160-chamilo-lms-unauthenticated-ssrf-in-pens-plugin"},{"cve":"CVE-2026-33715","cvss":7.2,"epss":0.0021,"slug":"cve-2026-33715-chamilo-lms-ssrf-and-open-email-relay-in-install-ajax-php","title":"Chamilo LMS SSRF and open email relay in install.ajax.php","severity":"high","exploited":false,"published_at":"2026-04-14T21:16:26.06+00:00","url":"https://junglewise.ai/threats/cve-2026-33715-chamilo-lms-ssrf-and-open-email-relay-in-install-ajax-php"},{"cve":"CVE-2026-33714","cvss":7.2,"epss":0.0026,"slug":"cve-2026-33714-chamilo-lms-sql-injection-in-statistics-ajax-endpoint","title":"Chamilo LMS SQL injection in statistics AJAX endpoint","severity":"high","exploited":false,"published_at":"2026-04-14T21:16:25.893+00:00","url":"https://junglewise.ai/threats/cve-2026-33714-chamilo-lms-sql-injection-in-statistics-ajax-endpoint"},{"cve":"CVE-2026-33737","cvss":5.3,"slug":"cve-2026-33737-chamilo-lms-xml-external-entity-injection-in-multiple-components","title":"Chamilo LMS XML External Entity injection in multiple components","severity":"medium","exploited":false,"published_at":"2026-04-10T19:16:24.56+00:00","url":"https://junglewise.ai/threats/cve-2026-33737-chamilo-lms-xml-external-entity-injection-in-multiple-components"},{"cve":"CVE-2026-33736","cvss":6.5,"slug":"cve-2026-33736-chamilo-lms-authorization-bypass-in-user-api","title":"Chamilo LMS authorization bypass in User API","severity":"medium","exploited":false,"published_at":"2026-04-10T19:16:24.41+00:00","url":"https://junglewise.ai/threats/cve-2026-33736-chamilo-lms-authorization-bypass-in-user-api"},{"cve":"CVE-2026-33710","cvss":7.5,"slug":"cve-2026-33710-chamilo-lms-predictable-rest-api-key-generation","title":"Chamilo LMS predictable REST API key generation","severity":"high","exploited":false,"published_at":"2026-04-10T19:16:24.257+00:00","url":"https://junglewise.ai/threats/cve-2026-33710-chamilo-lms-predictable-rest-api-key-generation"},{"cve":"CVE-2026-33708","cvss":6.5,"slug":"cve-2026-33708-chamilo-lms-information-disclosure-in-rest-api","title":"Chamilo LMS information disclosure in REST API","severity":"medium","exploited":false,"published_at":"2026-04-10T19:16:24.107+00:00","url":"https://junglewise.ai/threats/cve-2026-33708-chamilo-lms-information-disclosure-in-rest-api"},{"cve":"CVE-2026-33707","cvss":9.4,"slug":"cve-2026-33707-chamilo-lms-weak-password-recovery-mechanism-in-login-lib-php","title":"Chamilo LMS weak password recovery mechanism in login.lib.php","severity":"critical","exploited":false,"published_at":"2026-04-10T19:16:23.95+00:00","url":"https://junglewise.ai/threats/cve-2026-33707-chamilo-lms-weak-password-recovery-mechanism-in-login-lib-php"},{"cve":"CVE-2026-33706","cvss":7.1,"slug":"cve-2026-33706-chamilo-lms-privilege-escalation-in-rest-api","title":"Chamilo LMS privilege escalation in REST API","severity":"high","exploited":false,"published_at":"2026-04-10T19:16:23.8+00:00","url":"https://junglewise.ai/threats/cve-2026-33706-chamilo-lms-privilege-escalation-in-rest-api"},{"cve":"CVE-2026-33705","cvss":5.3,"slug":"cve-2026-33705-chamilo-lms-information-disclosure-in-twig-templates","title":"Chamilo LMS information disclosure in Twig templates","severity":"medium","exploited":false,"published_at":"2026-04-10T19:16:23.653+00:00","url":"https://junglewise.ai/threats/cve-2026-33705-chamilo-lms-information-disclosure-in-twig-templates"},{"cve":"CVE-2026-33704","cvss":7.1,"slug":"cve-2026-33704-chamilo-lms-remote-code-execution-via-bigupload-endpoint","title":"Chamilo LMS remote code execution via BigUpload endpoint","severity":"high","exploited":false,"published_at":"2026-04-10T19:16:23.48+00:00","url":"https://junglewise.ai/threats/cve-2026-33704-chamilo-lms-remote-code-execution-via-bigupload-endpoint"},{"cve":"CVE-2026-33703","cvss":6.5,"slug":"cve-2026-33703-chamilo-lms-idor-in-social-network-personal-data-endpoint","title":"Chamilo LMS IDOR in social-network personal-data endpoint","severity":"medium","exploited":false,"published_at":"2026-04-10T19:16:23.327+00:00","url":"https://junglewise.ai/threats/cve-2026-33703-chamilo-lms-idor-in-social-network-personal-data-endpoint"},{"cve":"CVE-2026-33702","cvss":7.1,"slug":"cve-2026-33702-chamilo-lms-idor-in-learning-path-progress-saving-endpoint","title":"Chamilo LMS IDOR in Learning Path progress saving endpoint","severity":"high","exploited":false,"published_at":"2026-04-10T19:16:23.177+00:00","url":"https://junglewise.ai/threats/cve-2026-33702-chamilo-lms-idor-in-learning-path-progress-saving-endpoint"},{"cve":"CVE-2026-33698","cvss":9.8,"slug":"cve-2026-33698-chamilo-lms-unauthenticated-rce-in-main-install-directory","title":"Chamilo LMS unauthenticated RCE in main/install directory","severity":"critical","exploited":false,"published_at":"2026-04-10T19:16:23.033+00:00","url":"https://junglewise.ai/threats/cve-2026-33698-chamilo-lms-unauthenticated-rce-in-main-install-directory"},{"cve":"CVE-2026-33618","cvss":8.8,"slug":"cve-2026-33618-chamilo-lms-eval-injection-in-platformconfigurationcontroller","title":"Chamilo LMS eval injection in PlatformConfigurationController","severity":"high","exploited":false,"published_at":"2026-04-10T19:16:22.853+00:00","url":"https://junglewise.ai/threats/cve-2026-33618-chamilo-lms-eval-injection-in-platformconfigurationcontroller"},{"cve":"CVE-2026-33141","cvss":6.5,"slug":"cve-2026-33141-chamilo-lms-idor-in-rest-api-stats-endpoint","title":"Chamilo LMS IDOR in REST API stats endpoint","severity":"medium","exploited":false,"published_at":"2026-04-10T18:16:42.743+00:00","url":"https://junglewise.ai/threats/cve-2026-33141-chamilo-lms-idor-in-rest-api-stats-endpoint"},{"cve":"CVE-2026-32932","cvss":4.7,"slug":"cve-2026-32932-chamilo-lms-open-redirect-in-session-course-edit-page","title":"Chamilo LMS open redirect in session course edit page","severity":"medium","exploited":false,"published_at":"2026-04-10T18:16:42.59+00:00","url":"https://junglewise.ai/threats/cve-2026-32932-chamilo-lms-open-redirect-in-session-course-edit-page"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Chamilo Lms","slug":"chamilo-lms","vendor":{"name":"Chamilo","slug":"chamilo","url":"https://junglewise.ai/threats/vendors/chamilo"},"aliases":[],"category":"cms","homepage":"https://chamilo.org/","repo_url":"https://github.com/chamilo/chamilo-lms","description":"Chamilo is an open-source learning management system (LMS) designed to improve access to education and knowledge globally.","url":"https://junglewise.ai/threats/technologies/chamilo-lms"},"most_severe":[{"cve":"CVE-2026-45140","cvss":9.8,"epss":0.0133,"slug":"cve-2026-45140-chamilo-lms-cstudio-upload-flow-unauthenticated-remote-code","title":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute a","severity":"critical","exploited":false,"published_at":"2026-09-17T21:17:12.44+00:00","url":"https://junglewise.ai/threats/cve-2026-45140-chamilo-lms-cstudio-upload-flow-unauthenticated-remote-code"},{"cve":"CVE-2026-33698","cvss":9.8,"slug":"cve-2026-33698-chamilo-lms-unauthenticated-rce-in-main-install-directory","title":"Chamilo LMS unauthenticated RCE in main/install directory","severity":"critical","exploited":false,"published_at":"2026-04-10T19:16:23.033+00:00","url":"https://junglewise.ai/threats/cve-2026-33698-chamilo-lms-unauthenticated-rce-in-main-install-directory"},{"cve":"CVE-2026-33707","cvss":9.4,"slug":"cve-2026-33707-chamilo-lms-weak-password-recovery-mechanism-in-login-lib-php","title":"Chamilo LMS weak password recovery mechanism in login.lib.php","severity":"critical","exploited":false,"published_at":"2026-04-10T19:16:23.95+00:00","url":"https://junglewise.ai/threats/cve-2026-33707-chamilo-lms-weak-password-recovery-mechanism-in-login-lib-php"},{"cve":"CVE-2026-39878","cvss":9.3,"slug":"cve-2026-39878-chamilo-lms-stored-xss-in-user-registration-form","title":"Chamilo LMS stored XSS in user registration form","severity":"critical","exploited":false,"published_at":"2026-07-20T18:16:51.713+00:00","url":"https://junglewise.ai/threats/cve-2026-39878-chamilo-lms-stored-xss-in-user-registration-form"},{"cve":"CVE-2026-32892","cvss":9.1,"slug":"cve-2026-32892-chamilo-lms-os-command-injection-in-file-move-function","title":"Chamilo LMS OS command injection in file move function","severity":"critical","exploited":false,"published_at":"2026-04-10T18:16:41.797+00:00","url":"https://junglewise.ai/threats/cve-2026-32892-chamilo-lms-os-command-injection-in-file-move-function"},{"cve":"CVE-2026-35196","cvss":8.8,"epss":0.0176,"slug":"cve-2026-35196-chamilo-lms-os-command-injection-in-gradebook-certificate-export","title":"Chamilo LMS OS command injection in gradebook certificate export","severity":"high","exploited":false,"published_at":"2026-04-14T22:16:31.993+00:00","url":"https://junglewise.ai/threats/cve-2026-35196-chamilo-lms-os-command-injection-in-gradebook-certificate-export"},{"cve":"CVE-2026-40291","cvss":8.8,"epss":0.0032,"slug":"cve-2026-40291-chamilo-lms-privilege-escalation-in-api-user-role-modification","title":"Chamilo LMS privilege escalation in API user role modification","severity":"high","exploited":false,"published_at":"2026-04-14T22:16:32.507+00:00","url":"https://junglewise.ai/threats/cve-2026-40291-chamilo-lms-privilege-escalation-in-api-user-role-modification"},{"cve":"CVE-2026-33618","cvss":8.8,"slug":"cve-2026-33618-chamilo-lms-eval-injection-in-platformconfigurationcontroller","title":"Chamilo LMS eval injection in PlatformConfigurationController","severity":"high","exploited":false,"published_at":"2026-04-10T19:16:22.853+00:00","url":"https://junglewise.ai/threats/cve-2026-33618-chamilo-lms-eval-injection-in-platformconfigurationcontroller"},{"cve":"CVE-2026-34160","cvss":8.6,"epss":0.0034,"slug":"cve-2026-34160-chamilo-lms-unauthenticated-ssrf-in-pens-plugin","title":"Chamilo LMS unauthenticated SSRF in PENS plugin","severity":"high","exploited":false,"published_at":"2026-04-14T21:16:26.227+00:00","url":"https://junglewise.ai/threats/cve-2026-34160-chamilo-lms-unauthenticated-ssrf-in-pens-plugin"},{"cve":"CVE-2026-31939","cvss":8.3,"slug":"cve-2026-31939-chamilo-lms-path-traversal-in-savescores-php","title":"Chamilo LMS path traversal in savescores.php","severity":"high","exploited":false,"published_at":"2026-04-10T18:16:41.313+00:00","url":"https://junglewise.ai/threats/cve-2026-31939-chamilo-lms-path-traversal-in-savescores-php"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}