PT-2026-22621 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-02 · CVE-2025-52564

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. The open parameter in the help.php file does not properly sanitize user-supplied input. This allows an attacker to inject arbitrary HTML through a specially crafted URL. The vulnerable parameter is open.

Recommendations Update to version 1.11.30 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-52564

GHSA-6FMM-QRX4-WGQC

Affected Products

Chamilo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52564.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/1ee2d8bb61b67e08946cd80b1a9b92c1a9959c7b · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6fmm-qrx4-wgqc · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/083b1d2b0c29b0cc0313a28165ad47bebae9dcb2 · Patch
• https://osv.dev/vulnerability/CVE-2025-52564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52564 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/cyberbivash/status/2028509887014060229 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028512275418546595 · Twitter Post
• https://twitter.com/CVEnew/status/2028510373037453545 · Twitter Post