PT-2026-32917 · Unknown · Chamilo Lms

Aastha2602 · CVE-2026-34161 · Published 2026-04-14 · Updated 2026-04-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description A Stored Cross-Site Scripting (XSS) issue exists in the social post attachment upload functionality. An authenticated user can upload a malicious HTML file containing JavaScript via the '/api/social post attachments' endpoint. The application serves the uploaded file through the contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, allowing the JavaScript to execute in the browser within the application origin. This can lead to session hijacking, account takeover, privilege escalation if an administrator views the link, and arbitrary actions performed on behalf of the victim.

Recommendations Update to version 2.0.0-RC.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34161

GHSA-273P-JW9W-3G22

Affected Products

Chamilo Lms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34161.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34161 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34161 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 · Note
• https://twitter.com/CVEnew/status/2044338926777934154 · Twitter Post