Stored Cross-Site Scripting in Chamilo LMS Affects Anonymous Users

CVE-2026-45144

What is CVE-2026-45144?

Chamilo LMS, an open-source learning management system, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in versions prior to 2.0.1. The vulnerability arises from the ability for an attacker, with ROLE_STUDENT access, to inject malicious HTML code into their own user profile by exploiting the GET /user/{username} endpoint. This endpoint is accessible without authentication, allowing anonymous users to register and assume the student role, thereby enabling them to plant harmful scripts in their profiles. When any user, including administrators, views the compromised profile, the injected script can execute in their browser, leading to potential account takeover through methods such as session hijacking or localStorage exfiltration. This critical issue was addressed in version 2.0.1 to mitigate such risks.

References