# CVE-2026-34161: Chamilo LMS Stored XSS in social post attachments

Source: https://junglewise.ai/threats/cve-2026-34161-chamilo-lms-stored-xss-in-social-post-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34161 · Severity: medium · CVSS 5.4 · Published 2026-04-14

Chamilo LMS, an open-source learning management system, contains a security flaw in its social post attachment feature. An authenticated user can upload a malicious file that, when viewed by others (including administrators), executes hidden code in their browser. This could allow an attacker to hijack user sessions, take over accounts, or perform unauthorized actions on behalf of students or staff.

Technologies: [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms). Vendors: [Chamilo](https://junglewise.ai/threats/vendors/chamilo).

## Quick answers

**Is CVE-2026-34161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34161 being exploited in the wild.

**How severe is CVE-2026-34161?** Medium severity, with a CVSS score of 5.4, published 14 April 2026.

**Which products and versions are affected?** Chamilo Lms < 2.0.0-RC.3.

**Is there a fix for CVE-2026-34161?** A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34161 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34161?** Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the /api/social_post_attachments endpoint of Chamilo LMS. The application fails to restrict file types or sanitize content during upload, and subsequently serves files from the contentUrl without a 'Content-Disposition: attachment' header or appropriate content-type restrictions. An authenticated attacker can upload a malicious HTML file containing JavaScript; when a victim views the generated link, the script executes within the application's origin. This can lead to session hijacking, account takeover, and privilege escalation if an administrator interacts with the malicious attachment. The issue is resolved in version 2.0.0-RC.3 by implementing a MIME-type allowlist and SVG sanitization.

## Affected products

- Chamilo Chamilo LMS < 2.0.0-RC.3

## Timeline

- 2026-04-01: patched: Version 2.0.0-RC.3 released
- 2026-04-14: advisory: GitHub Security Advisory published
- 2026-04-14: disclosed: CVE-2026-34161 published

## References

- [https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f](https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f)
- [https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da](https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da)
- [https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3](https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3)
- [https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22](https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22)

## Related threats

- [Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS unsafe deserialization in career data](https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0)
- [Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS arbitrary code execution in HTML_QuickForm](https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1)