Executive brief
Chamilo LMS is an open-source platform used by educational institutions to deliver online courses and manage learning activities. A student or low-privilege user can craft malicious messages and send them to administrators; when administrators view these messages in their inbox, JavaScript code embedded in the message automatically executes in their browser, potentially stealing session credentials or allowing the attacker to perform administrative actions without further user interaction.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS versions 2.0.0 through 2.1.0. The vulnerability exists because message content is stored in the database without server-side HTML sanitization and is rendered as raw HTML in two locations: the Vue.js component assets/vue/views/message/MessageShow.vue and the Twig template public/main/template/default/message/view_message.html.twig. An authenticated user with minimal privileges (e.g., a student) can exploit this by crafting a message with embedded JavaScript, selecting an administrator as the recipient, and sending it. The malicious script executes automatically when the recipient opens their inbox or views the message—no link click required. This grants the attacker access to the victim's session cookies and ability to perform administrative actions. The vulnerability was fixed in version 2.0.1 by introducing a MessageNormalizer to sanitize message content server-side.
Affected products
- Chamilo LMS 2.0.0 through 2.1.0
Timeline
- 2026-09-17: disclosed
- 2026-05-08: patched: Version 2.0.1 released with security fixes