PT-2026-22590 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-16 · CVE-2025-52482

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. A Stored Cross-Site Scripting (XSS) issue exists within the glossary function. Users with the Teachers role can inject JavaScript malicious code, potentially impacting the administrator. The glossary function allows for the storage of terms and definitions, and the vulnerability arises from insufficient input validation or sanitization when handling user-provided content within this function.

Recommendations Update to version 1.11.30 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52482

GHSA-4WCP-3RH3-7WM4

Affected Products

Chamilo

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52482.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/f9150075246df4ed9755a4a150e25edb468767be · Patch
• https://github.com/chamilo/chamilo-lms/commit/82cc07edd8ef316e6b36da7c501120d5c0aeb151 · Patch
• https://github.com/chamilo/chamilo-lms/commit/241c569dde0ad0e34d558ae51271f70438189b0e · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4wcp-3rh3-7wm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52482 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52482 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/cracbot/status/2030237100667494859 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028502076146204850 · Twitter Post
• https://twitter.com/CVEnew/status/2028500217524343033 · Twitter Post
• https://twitter.com/cracbot/status/2029874800970322304 · Twitter Post
• https://twitter.com/pulsepatchio/status/2028846304470716885 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028558121614934029 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028500599583785465 · Twitter Post