Reflected Cross-Site Scripting Vulnerability in Chamilo LMS by Chamilo

CVE-2026-32893

What is CVE-2026-32893?

Chamilo LMS, a widely-used learning management system, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability prior to version 2.0.0-RC.3. This flaw exists in the exercise question list admin panel, allowing an attacker to inject and execute arbitrary JavaScript code in the browser of an authenticated teacher. The issue arises from insufficient input handling in the pagination code, which improperly merges GET parameters and outputs them into HTML href attributes without the necessary encoding. This creates a vector for exploitation that could lead to unauthorized actions or data exposure. The vulnerability has been addressed in version 2.0.0-RC.3.

References