CVE-2025-66447: Chamilo LMS has validation-less redirect on login page

Q: Which deployments are affected?

Chamilo LMS versions from 1.11.0 through 2.0-beta.1 are affected. The issue is fixed in version 2.0-beta.2.

Q: Does an attacker need an account or user interaction to exploit this?

No account, privileges, or user interaction are required according to the supplied vector. Anyone can trigger the redirect by using the redirect parameter on the /login endpoint.

Q: What should be done if the installation cannot be patched immediately?

The provided data identifies the redirect parameter on /login as the affected input, but does not provide a validated workaround. Prioritize upgrading to 2.0-beta.2 or later.

Published Apr 10, 2026

Updated

Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2.

Affected Software

12 affected components

Chamilo Chamilo LMS>=1.11.0<=2.0-beta.1

Chamilo Chamilo LMS<=1.11.38

Chamilo Chamilo LMS=2.0.0-alpha1

Chamilo Chamilo LMS=2.0.0-alpha2

Chamilo Chamilo LMS=2.0.0-alpha3

Chamilo Chamilo LMS=2.0.0-alpha4

Chamilo Chamilo LMS=2.0.0-alpha5

Chamilo Chamilo LMS=2.0.0-beta1

Chamilo Chamilo LMS=2.0.0-beta2

Chamilo Chamilo LMS=2.0.0-beta3

Chamilo Chamilo LMS=2.0.0-rc1

Chamilo Chamilo LMS=2.0.0-rc2

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/73ae6293adaa6098374bc22625342dbae5cbc446

Event History

Apr 10, 2026

CVE Published

via MITRE·05:22 PM

Data Sourced

via MITRE·05:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

Chamilo LMS versions from 1.11.0 through 2.0-beta.1 are affected. The issue is fixed in version 2.0-beta.2.

Does an attacker need an account or user interaction to exploit this?

No account, privileges, or user interaction are required according to the supplied vector. Anyone can trigger the redirect by using the redirect parameter on the /login endpoint.

What should be done if the installation cannot be patched immediately?

The provided data identifies the redirect parameter on /login as the affected input, but does not provide a validated workaround. Prioritize upgrading to 2.0-beta.2 or later.

CVE-2025-66447: Chamilo LMS has validation-less redirect on login page

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction to exploit this?

What should be done if the installation cannot be patched immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction to exploit this?

What should be done if the installation cannot be patched immediately?