Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

Chamilo LMS lets student inject code into admin messages

CVE-2026-45143 · published 27 days ago
Summary

In Chamilo LMS versions 2.0.0 through 2.1.0, private messages are saved without cleaning the content and are shown as HTML to the recipient. A student can send a specially crafted message that runs code in an administrator’s browser when the admin opens the message, potentially stealing credentials or performing actions as the admin. Upgrade to version 2.0.1 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
chamilo chamilo-lms >= 2.0.0, < 2.0.1
Original advisory text
Chamilo LMS: Student-to-admin stored XSS in private messages via v-html
Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. An authenticated low-privilege user, including a student, can directly address crafted message content to an administrator because the message creation flow permits a sender to select another user as the recipient. The content executes in the recipient's browser when the recipient opens the routine inbox or message view, without requiring a link click, and can expose session credentials or permit actions as the administrator. This vulnerability is fixed in 2.0.1.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Sep 2026
Updated14 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-45143 · NVD
CVE-2026-45143 · MITRE
CVE-2026-45143 · OSV
GHSA-x88v-rg6r-vqq6 · GHSA
Track software like this
Free during beta