CVE-2025-50186: Chamilo: Stored XSS via Malicious CSV Filename in user_import.php
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50186?
CVE-2025-50186 has a medium severity level due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2025-50186?
To fix CVE-2025-50186, upgrade Chamilo to version 1.11.30 or later, which addresses the vulnerability.
What systems are affected by CVE-2025-50186?
CVE-2025-50186 affects Chamilo versions prior to 1.11.30.
What type of vulnerability is CVE-2025-50186?
CVE-2025-50186 is a stored cross-site scripting (XSS) vulnerability.
Can an attacker exploit CVE-2025-50186 easily?
Yes, an attacker can exploit CVE-2025-50186 by uploading a maliciously named CSV file without proper sanitization.