CVE-2026-45144 Details
Description
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.
A pre-authentication stored cross-site scripting vulnerability has been identified in Chamilo LMS versions 2.0.0 prior to 2.0.1. The issue arises in the user profile endpoint, which is accessible without authentication. The endpoint renders several user-editable fields, including 'firstname', 'lastname', 'competences', 'openarea', 'teach', and 'diplomas', without proper server-side sanitization. This allows a user with a ROLE_STUDENT to inject HTML into their profile. When the profile is viewed by others, including administrators, the injected HTML is executed in the browser, potentially leading to account takeover by exfiltrating session, JWT, or localStorage data.
Users can upgrade to Chamilo LMS version 2.0.1, which addresses this vulnerability by removing the unsafe autoescape directive in the profile template and implementing proper sanitization for the affected profile fields.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0c35057 | [email protected] | Source CodeVendor |
| https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1 | [email protected] | Release NotesVendor |
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chamilo LMS | >= 2.0.0, < 2.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |