PT-2026-23631 · Chamilo · Chamilo

Published 2026-03-06 · Updated 2026-03-17 · CVE-2025-55289

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system with a stored cross-site scripting (XSS) issue. The issue exists in the platform’s social network and internal messaging features. An attacker can inject arbitrary JavaScript code that executes in the browser of an authenticated user, including administrators, when they view the injected content. This can lead to full account takeover through session hijacking, unauthorized actions, and potential data theft. The vulnerable code is present in versions prior to 1.11.34.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-55289

GHSA-CCHJ-3QMF-82J5

Affected Products

Chamilo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55289.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-cchj-3qmf-82j5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55289 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/dishant_singh14/status/2033890313283244415 · Twitter Post
• https://twitter.com/CveFindCom/status/2029779374933696852 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029874878615277814 · Twitter Post
• https://twitter.com/cracbot/status/2031686813602230453 · Twitter Post