Executive brief
Classroomio LMS, an open-source education platform, contains a security flaw in how it handles course cover images. An authorized user, such as an instructor, can upload a specially crafted image file that contains hidden malicious code. When other users view the course page, this code runs automatically in their browser, potentially allowing the attacker to hijack user sessions or steal sensitive account information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Classroomio LMS version 0.1.13 due to improper sanitization of uploaded SVG files used as course cover images. An authenticated attacker can upload a malicious SVG file containing embedded JavaScript via the 'Header > replace image cover' functionality on a course landing page. When the image is rendered or viewed by other users, the embedded script executes within their browser session. This can lead to session hijacking, unauthorized actions on behalf of other users, or account takeover. The vulnerability is tracked as CWE-79 and requires a low-privileged authenticated user to perform the upload and a victim to view the affected page.
Affected products
- Classroomio Classroomio LMS 0.1.13
Timeline
- 2025-11-26: disclosed: Initial disclosure of CVE-2025-65676
- 2025-11-26: advisory: NVD published the vulnerability record