Live › vulnerability › CVE-2026-45144
Chamilo LMS 2.0.0 through 2.0.1 renders user profile fields without escaping, so HTML a user saves in their profile runs in the browser of anyone who opens it. An attacker can use this to steal sessions or tokens, including those of administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Any Chamilo LMS installation from 2.0.0 through 2.0.1 is exposed because the public profile page at /user/{username} outputs six user-editable fields without escaping. Self-registration, when enabled, lets an anonymous attacker gain the student role needed to plant the payload. Installations already on 2.0.1 or later are not affected by this issue.
No product ranges from the sources yet.
2.0.0 through 2.0.1.2.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields (firstname, lastname, competences, openarea, teach, and diplomas) inside {% autoescape false %}, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or localStorage exfiltration. This issue is fixed in version 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-45144")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.