CVE-2026-39878: Chamilo LMS stored XSS in user registration form

CVE-2026-39878 · Severity: critical · CVSS 9.3 · Published 2026-07-20

Chamilo LMS, a popular learning management system, contains a security flaw in its user registration form. An unauthorized attacker can submit a malicious registration that, when viewed by a system administrator, allows the attacker to take over the administrator's account. This grants the attacker full control over the platform, including access to all student data, grades, and course content.

Quick answers

Is CVE-2026-39878 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39878 being exploited in the wild.
How severe is CVE-2026-39878?
Critical severity, with a CVSS score of 9.3, published 20 July 2026.
Which products and versions are affected?
Chamilo Chamilo LMS <= 1.11.38.
Is there a fix for CVE-2026-39878?
A patch was published on 2026-07-20: Patch confirmed available in version 1.11.40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39878 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-39878?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Chamilo LMS versions <= 1.11.38 due to improper input sanitization in the user registration form (main/auth/inscription.php) and insufficient output encoding in the administrative user list (main/admin/user_list.php). The vulnerability stems from a bypass of the Security::remove_XSS() function using null byte insertion and the failure to use htmlspecialchars() with ENT_QUOTES when rendering user names in HTML 'alt' and 'title' attributes. An unauthenticated attacker can inject malicious JavaScript that executes when an administrator views the user list. This leads to a session takeover and full administrative access to the LMS platform. The issue is resolved in version 1.11.40.

Affected products

  • Chamilo Chamilo LMS <= 1.11.38

Timeline

  • 2026-07-07: advisory: GitHub Security Advisory published
  • 2026-07-20: disclosed: CVE published to NVD
  • 2026-07-20: patched: Patch confirmed available in version 1.11.40

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.