PT-2025-39212 · Chamilo · Chamilo

Published 2025-09-23 · Updated 2026-03-11 · CVE-2025-59541

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system. A Cross-Site Request Forgery (CSRF) issue allows an attacker to delete projects within a course without the victim’s consent. Sensitive actions, such as project deletion, do not implement anti-CSRF protections (tokens) and rely on GET based requests. An authenticated user (Trainer) can be tricked into performing this unwanted action by visiting a malicious page.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-59541

GHSA-RPJ6-P9M5-Q637

Affected Products

Chamilo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59541.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rpj6-p9m5-q637 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59541 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/prakhar0x01/status/1970548516926927099 · Twitter Post
• https://twitter.com/cracbot/status/2031686815363871013 · Twitter Post