# Chamilo Lms vulnerabilities Source: https://junglewise.ai/threats/technologies/chamilo-lms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/chamilo-lms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 42 vulnerabilities in Chamilo Lms: 0 in the last 7 days and 9 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-45146, was published on 3 November 2026. 8 vulnerabilities in the last four weeks, up 700% on the four before (1). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 9 - All time: 42 (5 critical, 0 exploited in the wild) ## About Chamilo Lms Chamilo LMS is an open-source learning management system for creating online courses and educational content. ## Latest Chamilo Lms vulnerabilities - [CVE-2026-45146: Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to) (high, CVSS 7.2, published 3 Nov 2026) - [CVE-2026-45145: Chamilo LMS unsafe deserialization in career data](https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to) (high, CVSS 7.5, published 30 Oct 2026) - [CVE-2026-45144: Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0) (high, CVSS 8.9, published 30 Oct 2026) - [CVE-2026-45141: Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-44344: Chamilo LMS arbitrary code execution in HTML_QuickForm](https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1) (medium, CVSS 6.6, published 30 Oct 2026) - [CVE-2026-114390: Chamilo LMS missing authorization in legacy AJAX handlers](https://junglewise.ai/threats/cve-2026-114390-chamilo-lms-from-2-0-0-alpha-1-before-2-0-0-rc-3-contains-a) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-114389: Chamilo LMS missing authorization in AiController](https://junglewise.ai/threats/cve-2026-114389-chamilo-lms-from-2-0-0-alpha-4-before-2-0-0-rc-3-contains-a) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-114388: Chamilo LMS missing access control in GradebookController](https://junglewise.ai/threats/cve-2026-114388-chamilo-lms-2-0-0-pre-releases-from-2-0-0-alpha-1-before-2-0-0) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-45140: Chamilo LMS CStudio upload flow unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-45140-chamilo-lms-cstudio-upload-flow-unauthenticated-remote-code) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2026-39878: Chamilo LMS stored XSS in user registration form](https://junglewise.ai/threats/cve-2026-39878-chamilo-lms-stored-xss-in-user-registration-form) (critical, CVSS 9.3, published 20 Jul 2026) - [CVE-2026-34239: Chamilo LMS remote code execution in lang.ajax.php](https://junglewise.ai/threats/cve-2026-34239-chamilo-lms-remote-code-execution-in-lang-ajax-php) (info, CVSS 7.5, published 20 Jul 2026) - [CVE-2026-40291: Chamilo LMS privilege escalation in API user role modification](https://junglewise.ai/threats/cve-2026-40291-chamilo-lms-privilege-escalation-in-api-user-role-modification) (high, CVSS 8.8, published 14 Apr 2026) - [CVE-2026-35196: Chamilo LMS OS command injection in gradebook certificate export](https://junglewise.ai/threats/cve-2026-35196-chamilo-lms-os-command-injection-in-gradebook-certificate-export) (high, CVSS 8.8, published 14 Apr 2026) - [CVE-2026-34602: Chamilo LMS IDOR in course enrollment API](https://junglewise.ai/threats/cve-2026-34602-chamilo-lms-idor-in-course-enrollment-api) (high, CVSS 7.1, published 14 Apr 2026) - [CVE-2026-34370: Chamilo LMS IDOR in notebook module](https://junglewise.ai/threats/cve-2026-34370-chamilo-lms-idor-in-notebook-module) (medium, CVSS 6.5, published 14 Apr 2026) - [CVE-2026-34161: Chamilo LMS Stored XSS in social post attachments](https://junglewise.ai/threats/cve-2026-34161-chamilo-lms-stored-xss-in-social-post-attachments) (medium, CVSS 5.4, published 14 Apr 2026) - [CVE-2026-34160: Chamilo LMS unauthenticated SSRF in PENS plugin](https://junglewise.ai/threats/cve-2026-34160-chamilo-lms-unauthenticated-ssrf-in-pens-plugin) (high, CVSS 8.6, published 14 Apr 2026) - [CVE-2026-33715: Chamilo LMS SSRF and open email relay in install.ajax.php](https://junglewise.ai/threats/cve-2026-33715-chamilo-lms-ssrf-and-open-email-relay-in-install-ajax-php) (high, CVSS 7.2, published 14 Apr 2026) - [CVE-2026-33714: Chamilo LMS SQL injection in statistics AJAX endpoint](https://junglewise.ai/threats/cve-2026-33714-chamilo-lms-sql-injection-in-statistics-ajax-endpoint) (high, CVSS 7.2, published 14 Apr 2026) - [CVE-2026-33737: Chamilo LMS XML External Entity injection in multiple components](https://junglewise.ai/threats/cve-2026-33737-chamilo-lms-xml-external-entity-injection-in-multiple-components) (medium, CVSS 5.3, published 10 Apr 2026) - [CVE-2026-33736: Chamilo LMS authorization bypass in User API](https://junglewise.ai/threats/cve-2026-33736-chamilo-lms-authorization-bypass-in-user-api) (medium, CVSS 6.5, published 10 Apr 2026) - [CVE-2026-33710: Chamilo LMS predictable REST API key generation](https://junglewise.ai/threats/cve-2026-33710-chamilo-lms-predictable-rest-api-key-generation) (high, CVSS 7.5, published 10 Apr 2026) - [CVE-2026-33708: Chamilo LMS information disclosure in REST API](https://junglewise.ai/threats/cve-2026-33708-chamilo-lms-information-disclosure-in-rest-api) (medium, CVSS 6.5, published 10 Apr 2026) - [CVE-2026-33707: Chamilo LMS weak password recovery mechanism in login.lib.php](https://junglewise.ai/threats/cve-2026-33707-chamilo-lms-weak-password-recovery-mechanism-in-login-lib-php) (critical, CVSS 9.4, published 10 Apr 2026) - [CVE-2026-33706: Chamilo LMS privilege escalation in REST API](https://junglewise.ai/threats/cve-2026-33706-chamilo-lms-privilege-escalation-in-rest-api) (high, CVSS 7.1, published 10 Apr 2026) ## Most severe Chamilo Lms vulnerabilities - [CVE-2026-45140: Chamilo LMS CStudio upload flow unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-45140-chamilo-lms-cstudio-upload-flow-unauthenticated-remote-code) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2026-33698: Chamilo LMS unauthenticated RCE in main/install directory](https://junglewise.ai/threats/cve-2026-33698-chamilo-lms-unauthenticated-rce-in-main-install-directory) (critical, CVSS 9.8, published 10 Apr 2026) - [CVE-2026-33707: Chamilo LMS weak password recovery mechanism in login.lib.php](https://junglewise.ai/threats/cve-2026-33707-chamilo-lms-weak-password-recovery-mechanism-in-login-lib-php) (critical, CVSS 9.4, published 10 Apr 2026) - [CVE-2026-39878: Chamilo LMS stored XSS in user registration form](https://junglewise.ai/threats/cve-2026-39878-chamilo-lms-stored-xss-in-user-registration-form) (critical, CVSS 9.3, published 20 Jul 2026) - [CVE-2026-32892: Chamilo LMS OS command injection in file move function](https://junglewise.ai/threats/cve-2026-32892-chamilo-lms-os-command-injection-in-file-move-function) (critical, CVSS 9.1, published 10 Apr 2026) - [CVE-2026-45144: Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0) (high, CVSS 8.9, published 30 Oct 2026) - [CVE-2026-35196: Chamilo LMS OS command injection in gradebook certificate export](https://junglewise.ai/threats/cve-2026-35196-chamilo-lms-os-command-injection-in-gradebook-certificate-export) (high, CVSS 8.8, published 14 Apr 2026) - [CVE-2026-40291: Chamilo LMS privilege escalation in API user role modification](https://junglewise.ai/threats/cve-2026-40291-chamilo-lms-privilege-escalation-in-api-user-role-modification) (high, CVSS 8.8, published 14 Apr 2026) - [CVE-2026-33618: Chamilo LMS eval injection in PlatformConfigurationController](https://junglewise.ai/threats/cve-2026-33618-chamilo-lms-eval-injection-in-platformconfigurationcontroller) (high, CVSS 8.8, published 10 Apr 2026) - [CVE-2026-34160: Chamilo LMS unauthenticated SSRF in PENS plugin](https://junglewise.ai/threats/cve-2026-34160-chamilo-lms-unauthenticated-ssrf-in-pens-plugin) (high, CVSS 8.6, published 14 Apr 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 700% on the four before (1). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Chamilo Lms vulnerabilities", https://junglewise.ai/threats/technologies/chamilo-lms, 11 November 2026.