Chamilo LMS: Stored XSS in public user-profile fields
Summary
| CVE | CVE-2026-45144 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-30 15:16:51 UTC |
| Updated | 2026-10-30 17:13:54 UTC |
| Description | Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1. |
Risk And Classification
Primary CVSS: v3.1 8.9 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
EPSS: 0.002290000 probability, percentile 0.137210000 (date 2026-11-01)
Problem Types: CWE-79 | CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.9 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
| 3.1 | CNA | DECLARED | 8.9 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
RequiredScope
ChangedConfidentiality
HighIntegrity
HighAvailability
LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Chamilo | Chamilo-lms | affected >= 2.0.0, < 2.0.1 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0... | [email protected] | github.com | |
| github.com/chamilo/chamilo-lms/releases/tag/v2.0.1 | [email protected] | github.com | |
| github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.