CVE-2026-45143: Chamilo LMS: Student-to-admin stored XSS in private messages via v-html
Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twig. An authenticated low-privilege user, including a student, can directly address crafted message content to an administrator because the message creation flow permits a sender to select another user as the recipient. The content executes in the recipient's browser when the recipient opens the routine inbox or message view, without requiring a link click, and can expose session credentials or permit actions as the administrator. This vulnerability is fixed in 2.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chamilo LMSto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
Who can exploit this issue, and what user interaction is required?
Any authenticated low-privilege account, including a student account, can send crafted private-message content to an administrator. The payload executes when the administrator opens the inbox or message view; no link click is required.
Which deployments are affected?
Chamilo LMS versions 2.0.0 through at least 2.1.0 are affected. The issue is fixed in version 2.0.1.
What is the impact if an administrator views a malicious message?
Script running in the administrator's browser can expose session credentials or perform actions with the administrator's privileges. Because attackers can select another user as a message recipient, they can directly target administrator accounts.