CVE-2025-52476: 
Chamilo vulnerability analysis and mitigation

CVE-2025-52476 is a reflected cross-site scripting (XSS) vulnerability in Chamilo LMS affecting all versions up to and including 1.11.28. The flaw stems from improper sanitization of the keyword_active parameter in admin/user_list.php, allowing an attacker to inject malicious scripts that execute in a victim's browser. The vulnerability was disclosed on March 2, 2026, and patched in version 1.11.30. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), with additional weaknesses CWE-80 (Improper Neutralization of Script-Related HTML Tags) and CWE-87 (Improper Neutralization of Alternate XSS Syntax). The vulnerable code in main/inc/lib/sortable_table.class.php directly embedded unsanitized user-supplied values into HTML hidden input fields without proper encoding. The fix refactored hidden input generation to use the Display::input() method combined with Security::remove_XSS() to sanitize both keys and values before rendering. Notably, the advisory states that exploitation requires the victim to press a specific keyboard shortcut (ALT+SHIFT+X on Windows/Linux or CTRL+ALT+X on macOS), which is an unusual precondition that significantly limits exploitability (GitHub Advisory, Patch Commit).

Successful exploitation could allow an attacker to steal administrator session tokens or credentials by tricking an admin into clicking a crafted URL and triggering the keyboard shortcut, potentially compromising the entire Chamilo platform's user management functionality. The vulnerability has low confidentiality and integrity impact with no availability impact, as injected scripts execute in the context of the victim's browser session. Given that the target endpoint is the admin user list, a successful attack could lead to account takeover of privileged users, enabling further unauthorized actions within the LMS (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.045%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The unusual exploitation precondition — requiring the victim to press a specific keyboard shortcut — further reduces the practical risk of mass exploitation.

1. Reconnaissance: Identify Chamilo LMS instances running versions ≤1.11.28 that are accessible over the network, particularly the admin panel at admin/user_list.php.
2. Craft malicious URL: Construct a URL targeting the admin/user_list.php endpoint with a malicious payload injected into the keyword_active parameter, e.g., https://target.example.com/main/admin/user_list.php?keyword_active=<script>malicious_payload</script>.
3. Deliver to victim: Send the crafted URL to a Chamilo administrator via phishing email, chat message, or other social engineering vector.
4. Trigger execution: The victim must be logged in as an administrator and must press ALT+SHIFT+X (Windows/Linux) or CTRL+ALT+X (macOS) while on the page for the injected script to execute.
5. Achieve objective: The executed script runs in the administrator's browser context, enabling theft of session cookies, credential harvesting, or other malicious actions against the Chamilo platform (GitHub Advisory).

• Network: Unusual HTTP GET requests to /main/admin/user_list.php containing URL-encoded script tags or JavaScript payloads in the keyword_active parameter.
• Logs: Web server access logs showing requests to admin/user_list.php with anomalous or encoded values in the keyword_active query parameter from unexpected source IPs.
• Logs: Application logs indicating admin sessions accessed from unusual IP addresses or user agents shortly after suspicious requests to the user list endpoint.

Upgrade Chamilo LMS to version 1.11.30 or later, which was released as a security patch release addressing this and related vulnerabilities (Chamilo Release). The patch refactors hidden input generation in sortable_table.class.php to use Display::input() with Security::remove_XSS() sanitization (Patch Commit). As a defense-in-depth measure, implement a Content Security Policy (CSP) header to restrict script execution, and ensure administrator accounts use strong, unique credentials and are accessed only from trusted networks.