Chamilo Chamilo-Lms vulnerabilities

CVE-2025-55208 [CRITICAL] CWE-79 CVE-2025-55208: Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecur Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account. Version 1.11.34 fixes the issue.

CVE-2025-50194 [HIGH] CWE-78 CVE-2025-50194: Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30.

CVE-2025-50199 [CRITICAL] CWE-918 CVE-2025-50199: Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerabili Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.

CVE-2026-45143 [CRITICAL] CWE-79 CVE-2026-45143: Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. An authenticated low-privilege user, including a

CVE-2026-31939 [HIGH] CWE-22 CVE-2026-31939: Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exe Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

CVE-2026-39878 [CRITICAL] CWE-79 CVE-2026-39878: Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

CVE-2025-50196 [HIGH] CWE-78 CVE-2025-50196: Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30.

CVE-2025-50195 [HIGH] CWE-78 CVE-2025-50195: Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30.

CVE-2025-50193 [HIGH] CWE-78 CVE-2025-50193: Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.

CVE-2025-50197 [HIGH] CWE-78 CVE-2025-50197: Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.

CVE-2025-55289 [CRITICAL] CWE-79 CVE-2025-55289: Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerabili Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user (including administrators), the payload executes in their b

CVE-2026-34239 [HIGH] CWE-285 CVE-2026-34239: Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the mai Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.

CVE-2026-33715 [HIGH] CWE-306 CVE-2026-33715: Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/ Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer

CVE-2026-31940 [HIGH] CWE-384 CVE-2026-31940: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.p Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

CVE-2026-33710 [HIGH] CWE-330 CVE-2026-33710: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are gene Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key

CVE-2025-50188 [HIGH] CWE-89 CVE-2025-50188: Chamilo is a learning management system. Prior to version 1.11.30, the application performs insuffic Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the databa

CVE-2025-50191 [HIGH] CWE-89 CVE-2025-50191: Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injec Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.

CVE-2025-59542 [CRITICAL] CWE-79 CVE-2025-59542: Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scri Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the co

CVE-2026-34602 [HIGH] CWE-639 CVE-2026-34602: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/ Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The

CVE-2025-59543 [CRITICAL] CWE-79 CVE-2025-59543: Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scri Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course inform