XSS in Chamilo Chamilo-Lms
CVE-2026-45144
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Chamilo Chamilo-Lms — versions >= 2.0.0, < 2.0.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-45144?
- CVE-2026-45144 is a high-severity vulnerability in Chamilo Chamilo-Lms, classified under Cross-site Scripting. CVSS score: 8.9/10. Published 2026-10-30.
- How severe is CVE-2026-45144?
- High severity. CVSS v3 base score is 8.9 out of 10.