Stored Cross-Site Scripting Vulnerability in Chamilo LMS by Chamilo

CVE-2026-82535

What is CVE-2026-82535?

Chamilo LMS versions prior to 1.11.42 and 3.0.0 are susceptible to a stored cross-site scripting vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts into survey answers via deterministic invitation codes, circumventing authorization checks in the survey submission endpoint. As a result, attackers may submit crafted responses that include unescaped HTML. When teachers or administrators view these responses, arbitrary scripts could be executed in their browser sessions, potentially leading to persistent backdoor account creation by exploiting the victims' authenticated sessions.

References