PT-2026-22588 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-02 · CVE-2025-50186

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo, a learning management system, contains a stored cross-site scripting (XSS) issue. This is due to inadequate sanitization of CSV filenames. An attacker can upload a CSV file with a malicious name, such as <img src=q onerror=prompt(8)>.csv, which results in JavaScript execution when administrators or users with access to import logs or file views access it. The vulnerability is triggered when a maliciously crafted CSV filename is processed, allowing for the injection of arbitrary JavaScript code. The vulnerable component is the CSV file processing functionality.

Recommendations Update to Chamilo version 1.11.30 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-50186

GHSA-WRX6-5V5R-MMGX

Affected Products

Chamilo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50186.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wrx6-5v5r-mmgx · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/9fef8f30b41d586cb4f4fc823906c16a12ae0ff4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-50186 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50186 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/VulmonFeeds/status/2028565801217781842 · Twitter Post
• https://twitter.com/CVEnew/status/2028500219512475774 · Twitter Post