# CVE-2026-45144: Chamilo LMS stored XSS in user profile fields

Source: https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-45144 · Severity: high · CVSS 8.9 · Published 2026-10-30

Chamilo LMS, an open-source learning management system, allows unauthenticated access to public user profiles that display six user-editable fields without proper sanitization. An attacker with a student role (or obtained through self-registration) can inject malicious HTML/JavaScript into their profile, which then executes in the browsers of other users—including administrators—who visit that profile, enabling session hijacking or account takeover.

Technologies: [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms). Vendors: [Chamilo](https://junglewise.ai/threats/vendors/chamilo).

## Quick answers

**Is CVE-2026-45144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45144 being exploited in the wild.

**How severe is CVE-2026-45144?** High severity, with a CVSS score of 8.9, published 30 October 2026.

**Which products and versions are affected?** Chamilo Lms 2.0.0 to before 2.0.1.

**Is there a fix for CVE-2026-45144?** Yes: fixed in 2.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45144 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45144?** Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.1

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the GET /user/{username} endpoint, which is publicly accessible and renders user profile fields (firstname, lastname, competences, openarea, teach, diplomas) within an unescaped Twig template block (`{% autoescape false %}`) without server-side sanitization. An attacker with ROLE_STUDENT can plant arbitrary HTML; if self-registration is enabled, an otherwise anonymous attacker can register, obtain student role, and craft malicious content. The injected payload executes for all visitors, including high-privilege administrators.

## Affected products

- Chamilo LMS 2.0.0 to before 2.0.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0c35057](https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0c35057)
- [https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1](https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1)

## Related threats

- [Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS unsafe deserialization in career data](https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS arbitrary code execution in HTML_QuickForm](https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1)
- [Chamilo LMS missing authorization in legacy AJAX handlers](https://junglewise.ai/threats/cve-2026-114390-chamilo-lms-from-2-0-0-alpha-1-before-2-0-0-rc-3-contains-a)