CVE-2026-82535: Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chamilo LMSto a version that resolves this vulnerability.Fixed in 1.11.42 - Upgrade
Upgrade
Chamilo LMSto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any Chamilo LMS instance before 1.11.42 or 3.0.0 is affected. An attacker does not need an authenticated account, but exploitation relies on a teacher or administrator later viewing the affected survey reporting output.
What does an attacker need to exploit this issue?
The attacker needs to compute deterministic survey invitation codes and submit a crafted survey answer containing malicious HTML. No privileges are required, and the attack is network-accessible, although victim interaction is required when an authenticated teacher or administrator views the report.
What is the impact if the payload executes?
The script executes in the browser session of the teacher or administrator viewing the reporting page. The described impact includes using that authenticated session to create persistent backdoor accounts.