PT-2026-23510 · Chamilo · Chamilo

Published 2026-03-05 · Updated 2026-03-17 · CVE-2025-55208

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo, a learning management system, contains a Stored Cross-Site Scripting (XSS) issue stemming from insecure file uploads within the Social Networks feature. A user with limited privileges can execute arbitrary code within the administrator's inbox, potentially leading to account takeover. The issue is related to file uploads and the Social Networks component. The vulnerable parameter is not specified.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-55208

GHSA-2VQ2-826H-6HP6

Affected Products

Chamilo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55208.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-2vq2-826h-6hp6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55208 · Security Note
• https://twitter.com/TheHackerWire/status/2030312535203995973 · Twitter Post
• https://twitter.com/CveFindCom/status/2029673650337571080 · Twitter Post
• https://twitter.com/dishant_singh14/status/2033890313283244415 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029710078308192393 · Twitter Post
• https://twitter.com/dailycve/status/2031172207653621786 · Twitter Post
• https://twitter.com/CVEnew/status/2030385205060514246 · Twitter Post