PT-2026-22615 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-07 · CVE-2025-52468

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo, a learning management system, contains an input validation issue when importing user data from CSV files. Insufficient sanitization of the "Last Name", "First Name", and "Username" fields allows for the injection of a stored cross-site scripting (XSS) payload. This payload is triggered when a user profile is viewed, potentially leading to malicious script execution within the context of an authenticated user. The vulnerable code does not properly validate user-supplied data during the import process.

Recommendations Update to version 1.11.30 or later to address this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52468

GHSA-HC3C-8P55-XH4R

Affected Products

Chamilo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52468.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hc3c-8p55-xh4r · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/790ef513aceacae6fe5b6641145901f04c7992dd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-52468 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52468 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/pulsepatchio/status/2029206903792775227 · Twitter Post
• https://twitter.com/cracbot/status/2030237133521490381 · Twitter Post
• https://twitter.com/CveFindCom/status/2028511075734303022 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028507981835608427 · Twitter Post
• https://twitter.com/cracbot/status/2029874838349959270 · Twitter Post
• https://twitter.com/cracbot/status/2029512378816323784 · Twitter Post