CVE-2026-32893: Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's browser. The pagination code merges all $GET parameters via arraymerge() and outputs the result via httpbuildquery() directly into HTML href attributes without htmlspecialchars() encoding. This vulnerability is fixed in 2.0.0-RC.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32893?
The severity of CVE-2026-32893 is classified based on the potential for an attacker to exploit the reflected XSS vulnerability.
How do I fix CVE-2026-32893?
To fix CVE-2026-32893, upgrade Chamilo LMS to version 2.0.0-RC.3 or later.
What versions of Chamilo LMS are affected by CVE-2026-32893?
Versions prior to 2.0.0-RC.3, including all alpha, beta, and other RC versions leading up to that point, are affected by CVE-2026-32893.
What types of attacks can CVE-2026-32893 facilitate?
CVE-2026-32893 can facilitate reflected Cross-Site Scripting (XSS) attacks, allowing attackers to execute arbitrary scripts in the user’s browser.
Is CVE-2026-32893 a common vulnerability in Chamilo LMS?
While the prevalence of CVE-2026-32893 can vary, any XSS vulnerability is considered serious due to its potential impact on user security.