CVE-2026-34161: Chamilo LMS Stored XSS in social post attachments

CVE-2026-34161 · Severity: medium · CVSS 5.4 · Published 2026-04-14

Chamilo LMS, an open-source learning management system, contains a security flaw in its social post attachment feature. An authenticated user can upload a malicious file that, when viewed by others (including administrators), executes hidden code in their browser. This could allow an attacker to hijack user sessions, take over accounts, or perform unauthorized actions on behalf of students or staff.

Technologies: Chamilo Lms. Vendors: Chamilo.

Quick answers

Is CVE-2026-34161 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34161 being exploited in the wild.
How severe is CVE-2026-34161?
Medium severity, with a CVSS score of 5.4, published 14 April 2026.
Which products and versions are affected?
Chamilo Lms < 2.0.0-RC.3.
Is there a fix for CVE-2026-34161?
A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34161 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34161?
Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the /api/social_post_attachments endpoint of Chamilo LMS. The application fails to restrict file types or sanitize content during upload, and subsequently serves files from the contentUrl without a 'Content-Disposition: attachment' header or appropriate content-type restrictions. An authenticated attacker can upload a malicious HTML file containing JavaScript; when a victim views the generated link, the script executes within the application's origin. This can lead to session hijacking, account takeover, and privilege escalation if an administrator interacts with the malicious attachment. The issue is resolved in version 2.0.0-RC.3 by implementing a MIME-type allowlist and SVG sanitization.

Affected products

  • Chamilo Chamilo LMS < 2.0.0-RC.3

Timeline

  • 2026-04-01: patched: Version 2.0.0-RC.3 released
  • 2026-04-14: advisory: GitHub Security Advisory published
  • 2026-04-14: disclosed: CVE-2026-34161 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.