Executive brief
Chamilo LMS, an open-source learning management system, contains a security flaw in its social post attachment feature. An authenticated user can upload a malicious file that, when viewed by others (including administrators), executes hidden code in their browser. This could allow an attacker to hijack user sessions, take over accounts, or perform unauthorized actions on behalf of students or staff.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the /api/social_post_attachments endpoint of Chamilo LMS. The application fails to restrict file types or sanitize content during upload, and subsequently serves files from the contentUrl without a 'Content-Disposition: attachment' header or appropriate content-type restrictions. An authenticated attacker can upload a malicious HTML file containing JavaScript; when a victim views the generated link, the script executes within the application's origin. This can lead to session hijacking, account takeover, and privilege escalation if an administrator interacts with the malicious attachment. The issue is resolved in version 2.0.0-RC.3 by implementing a MIME-type allowlist and SVG sanitization.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-01: patched: Version 2.0.0-RC.3 released
- 2026-04-14: advisory: GitHub Security Advisory published
- 2026-04-14: disclosed: CVE-2026-34161 published
References
- https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f
- https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22