Stored Cross-Site Scripting Vulnerability in Chamilo LMS

CVE-2026-34161

What is CVE-2026-34161?

Chamilo LMS, an open-source learning management system, has a vulnerability that allows authenticated users to upload malicious HTML files via the /api/social_post_attachments endpoint. This stored Cross-Site Scripting (XSS) issue arises from a lack of proper sanitization and content-type restrictions, causing JavaScript code to be executed in the browser when the uploaded content is accessed. Since the payload is stored on the server, an attacker can exploit this weakness to hijack user sessions, escalate privileges, or perform unintended actions on behalf of victims. It is essential to upgrade to version 2.0.0-RC.3 or later to mitigate this risk.

References