{"id":"CVE-2026-45144","kind":"vulnerability","aliases":["CVE-2026-45144"],"related":[],"title":"Chamilo LMS: profile fields store HTML that runs in visitors' browsers","description":"Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.","summary":"Chamilo LMS 2.0.0 through 2.0.1 renders user profile fields without escaping, so HTML a user saves in their profile runs in the browser of anyone who opens it. An attacker can use this to steal sessions or tokens, including those of administrators.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chamilo-lms","package","php","self-hosted"],"not_affected_if":["self-registration-disabled-and-no-untrusted-students","version-2.0.1-or-later"],"how_to_check":"- Check the installed Chamilo LMS version in the application or its composer metadata; affected versions are `2.0.0` through `2.0.1`.\n- Confirm whether self-registration is enabled in the Chamilo platform settings, since it lets anonymous visitors obtain the student role.","fix":"- Chamilo LMS: upgrade to `2.0.1` or later.","status":"open","published_at":"2026-10-30T15:16:51+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:09+00:00","updated_at":"2026-10-30T15:33:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T15:33:09Z","model":"claude-haiku-5-5","output":{"fix":"- Chamilo LMS: upgrade to `2.0.1` or later.","reach":"internet","title":"Chamilo LMS: profile fields store HTML that runs in visitors' browsers","impact":"high","summary":"Chamilo LMS 2.0.0 through 2.0.1 renders user profile fields without escaping, so HTML a user saves in their profile runs in the browser of anyone who opens it. An attacker can use this to steal sessions or tokens, including those of administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chamilo-lms","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs script in admin browsers and steals session tokens","analyst_note":"","how_to_check":"- Check the installed Chamilo LMS version in the application or its composer metadata; affected versions are `2.0.0` through `2.0.1`.\n- Confirm whether self-registration is enabled in the Chamilo platform settings, since it lets anonymous visitors obtain the student role.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.0.1-or-later","self-registration-disabled-and-no-untrusted-students"],"who_is_affected":"Any Chamilo LMS installation from 2.0.0 through 2.0.1 is exposed because the public profile page at /user/{username} outputs six user-editable fields without escaping. Self-registration, when enabled, lets an anonymous attacker gain the student role needed to plant the payload. Installations already on 2.0.1 or later are not affected by this issue.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4264,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-45144':14A,17A '/user':83C '2.0.0':28B,79C '2.0.1':30B,81C,173C 'account':159C 'administr':67B,150C 'allow':158C 'anonym':86C,134C 'anyon':50B 'attack':55B,118C,135C 'autoescap':104C 'browser':11A,48B,145C 'chamilo':1A,19B,26B,68C 'chamilo-lm':18B 'compet':98C 'content':141C 'cve':12A,15A 'diploma':102C 'edit':93C 'enabl':130C 'escap':36B 'execut':142C 'exfiltr':166C 'fals':105C 'field':4A,34B,95C 'firstnam':96C 'fix':170C 'follow':152C 'get':82C 'host':25B 'html':6A,38B,121C 'includ':64B,149C 'insid':103C 'issu':168C 'jwt':163C 'lastnam':97C 'learn':75C 'let':131C 'link':156C 'lms':2A,20B,27B,69C 'localstorag':165C 'manag':76C 'obtain':136C 'open':52B,73C 'open-sourc':72C 'openarea':99C 'otherwis':133C 'packag':21B 'path':114C 'php':22B 'plant':120C 'potenti':157C 'profil':3A,33B,44B,94C,125C,155C 'public':154C 'reachabl':87C 'registr':128C 'render':31B,89C 'role':116C,138C 'run':8A,45B 'sanit':110C 'save':41B 'self':24B,127C 'self-host':23B 'self-registr':126C 'server':108C 'server-sid':107C 'session':61B,162C 'side':109C 'six':90C 'sourc':74C 'steal':60B 'store':5A,140C 'student':117C 'system':77C 'takeov':160C 'teach':100C 'token':63B 'use':57B 'user':32B,40B,92C 'user-edit':91C 'usernam':84C 'version':172C 'visitor':10A,148C 'without':35B,106C 'write':113C","nicknames":[],"mitigations":[],"who_affected":"Any Chamilo LMS installation from 2.0.0 through 2.0.1 is exposed because the public profile page at /user/{username} outputs six user-editable fields without escaping. Self-registration, when enabled, lets an anonymous attacker gain the student role needed to plant the payload. Installations already on 2.0.1 or later are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-45144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45144","severity":null,"published_at":"2026-10-30T15:16:51+00:00","modified_at":"2026-10-30T15:16:51+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}