---
id: "CVE-2026-45144"
kind: "vulnerability"
aliases: ["CVE-2026-45144"]
title: "Chamilo LMS: profile fields store HTML that runs in visitors' browsers"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chamilo-lms", "package", "php", "self-hosted"]
not_affected_if: ["self-registration-disabled-and-no-untrusted-students", "version-2.0.1-or-later"]
published_at: "2026-10-30T15:16:51+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45144", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# Chamilo LMS: profile fields store HTML that runs in visitors' browsers

Chamilo LMS 2.0.0 through 2.0.1 renders user profile fields without escaping, so HTML a user saves in their profile runs in the browser of anyone who opens it. An attacker can use this to steal sessions or tokens, including those of administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chamilo LMS version in the application or its composer metadata; affected versions are `2.0.0` through `2.0.1`.
- Confirm whether self-registration is enabled in the Chamilo platform settings, since it lets anonymous visitors obtain the student role.

## Fix

- Chamilo LMS: upgrade to `2.0.1` or later.

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-45144

## From the sources

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_