Executive brief
Chamilo LMS, a popular open-source learning management system, contains a security flaw in its administrative panel for managing exercise questions. An attacker can trick an authenticated teacher into clicking a malicious link, allowing the attacker to execute unauthorized commands in the teacher's browser. This could lead to the theft of session cookies, unauthorized modification of grades, or the deletion of course content.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Chamilo LMS within the 'question_list_admin.inc.php' component. The vulnerability is caused by the pagination logic merging all incoming $_GET parameters using array_merge() and then outputting them via http_build_query() directly into HTML 'href' attributes without proper HTML entity encoding (e.g., htmlspecialchars). Because http_build_query() does not escape double quotes used in parameter keys, an attacker can provide a crafted URL that breaks out of the attribute context to inject arbitrary JavaScript. Exploitation requires a victim with teacher-level privileges to interact with a malicious link. Successful exploitation allows for session hijacking, grade manipulation, or course content modification. The issue is resolved in version 2.0.0-RC.3 by implementing an allow-list for query parameters.
Affected products
- Chamilo Chamilo LMS Prior to 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE-2026-32893 published
- 2026-04-10: patched: Fix committed to repository