CVE-2025-55289: Chamilo: Stored Cross Site Scripting in Skills Argumentation
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user (including administrators), the payload executes in their browser within the LMS context. This enables full account takeover via session hijacking, unauthorized actions with the victim’s privileges, exfiltration of sensitive data, and potential self-propagation to other users. This issue has been patched in version 1.11.34.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55289?
CVE-2025-55289 has a medium severity rating due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2025-55289?
To resolve CVE-2025-55289, update Chamilo LMS to version 1.11.34 or later.
What type of vulnerability is CVE-2025-55289?
CVE-2025-55289 is a stored cross-site scripting (XSS) vulnerability affecting Chamilo LMS.
Which version of Chamilo LMS is affected by CVE-2025-55289?
CVE-2025-55289 affects Chamilo LMS versions prior to 1.11.34, specifically version 1.11.32.
What can an attacker do with CVE-2025-55289?
An attacker can inject arbitrary JavaScript into the platform’s social network and internal messaging features due to CVE-2025-55289.