PT-2026-22588 · Chamilo · Chamilo

Publicado 2026-03-02 · Atualizado 2026-03-02 · CVE-2025-50186

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo, a learning management system, contains a stored cross-site scripting (XSS) issue. This is due to inadequate sanitization of CSV filenames. An attacker can upload a CSV file with a malicious name, such as <img src=q onerror=prompt(8)>.csv, which results in JavaScript execution when administrators or users with access to import logs or file views access it. The vulnerability is triggered when a maliciously crafted CSV filename is processed, allowing for the injection of arbitrary JavaScript code. The vulnerable component is the CSV file processing functionality.

Recommendations Update to Chamilo version 1.11.30 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-50186

GHSA-WRX6-5V5R-MMGX

Produtos afetados

Chamilo

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50186.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wrx6-5v5r-mmgx · Aviso do Fabricante
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Nota
• https://github.com/chamilo/chamilo-lms/commit/9fef8f30b41d586cb4f4fc823906c16a12ae0ff4 · Correção
• https://twitter.com/VulmonFeeds/status/2028565801217781842 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-50186 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-50186 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2028500219512475774 · Publicação no Twitter