Executive brief
Chamilo LMS, a platform used for online learning and collaboration, contains a flaw that allows attackers to redirect users to malicious websites. By sending a specially crafted link to a student or teacher, an attacker can trick them into visiting a fake login page or a site hosting malware while making it appear as though the link is from the trusted school portal. This can lead to credential theft or phishing attacks that damage the institution's reputation.
Technical details
An open redirect vulnerability (CWE-601) exists in Chamilo LMS versions 1.11.0 through 2.0-beta.1. The vulnerability is located in the '/login' endpoint, which fails to properly validate the 'redirect' parameter before performing a redirection. A remote, unauthenticated attacker can exploit this by crafting a URL that points to an external, malicious domain. While the CNA (GitHub) assigned a score of 0.0, NIST's analysis assigned a 4.7 (Medium) due to the potential for phishing and the requirement of user interaction. The issue is resolved in version 2.0-beta.2 by restricting redirects to same-origin URLs or validated relative paths.
Affected products
- Chamilo Chamilo LMS 1.11.0 to 2.0-beta.1
Timeline
- 2026-04-10: advisory: GHSA-m82x-prv3-rwwv published
- 2026-04-10: disclosed: CVE-2025-66447 published
- 2026-04-17: other: NIST completed initial analysis and updated CVSS score