PT-2026-32002 · Unknown · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-32893

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description Chamilo LMS, a learning management system, contains a Reflected Cross-Site Scripting (XSS) issue in the exercise question list admin panel. The vulnerability occurs because the pagination code uses array merge() to combine all $ GET parameters and then outputs the result through http build query() directly into HTML href attributes without proper htmlspecialchars() encoding. This allows an attacker to execute arbitrary JavaScript code in the browser of an authenticated teacher.

Recommendations Update to version 2.0.0-RC.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32893

Affected Products

Chamilo Lms

References · 5

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-37jh-g64j-88mc · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/72bc403f89b1ebb73a139f8f6cf0478857592276 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32893 · Security Note
• https://twitter.com/VulmonFeeds/status/2042797325714706637 · Twitter Post
• https://twitter.com/CVEnew/status/2042710211522130128 · Twitter Post