CVE-2025-52564: 
Chamilo vulnerability analysis and mitigation

CVE-2025-52564 is an HTML injection vulnerability (Basic XSS) in Chamilo LMS affecting the open parameter of help.php. The parameter fails to properly sanitize user input, allowing an unauthenticated attacker to inject arbitrary HTML content via a crafted URL. All Chamilo LMS versions up to and including 1.11.28 are affected; the issue was disclosed on March 2, 2026, and patched in version 1.11.30. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page — Basic XSS). The open GET parameter in main/help/help.php was passed through Security::remove_XSS() but was not validated against an allowlist of permitted values, enabling injection of arbitrary HTML tags into the rendered page. The fix introduced a whitelist of allowed help topic names (e.g., Blogs, Exercise, Wiki) and rejects any value not in that list, preventing unsanitized content from reaching the browser (GitHub Commit, GitHub Advisory). Exploitation requires no authentication but does require a victim to click a crafted link (user interaction required).

Successful exploitation allows an attacker to inject arbitrary HTML into pages viewed by Chamilo LMS users, enabling phishing attacks, display of fake login forms for credential harvesting, and content spoofing. Confidentiality and integrity are both at low risk — sensitive user information could be exposed through social engineering, and the displayed content can be manipulated. Availability is not impacted, and the vulnerability does not provide direct server-side code execution (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.047%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is straightforward for any unauthenticated attacker who can craft a malicious URL and deliver it to a victim (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Chamilo LMS instances running versions ≤1.11.28 using search engines or web scanners targeting the /main/help/help.php endpoint.
2. Craft malicious URL: Construct a URL targeting the vulnerable open parameter with an HTML injection payload, for example: https://target.example.com/main/help/help.php?open=<u>Injected+Content</u> or a more malicious payload such as a fake login form.
3. Deliver the link: Send the crafted URL to a target user via email, chat, or other social engineering channels, enticing them to click it.
4. HTML injection executes: When the victim visits the URL, the injected HTML is rendered in their browser within the Chamilo LMS context, potentially displaying phishing content, fake credential prompts, or other deceptive material (GitHub Advisory).

• Network: HTTP GET requests to /main/help/help.php with the open parameter containing HTML tags (e.g., <, >, <u>, <form>, <img) or URL-encoded equivalents (%3C, %3E).
• Logs: Web server access logs showing unusual or unexpected values in the open query parameter of requests to help.php, particularly those containing HTML markup or script-related characters.
• Logs: Referrer headers in server logs pointing to external or unknown domains when users access the help.php endpoint, which may indicate a phishing campaign delivering crafted links.

Chamilo has released version 1.11.30 as a security patch release that addresses this vulnerability by implementing a whitelist of allowed help topic values in help.php (GitHub Release, GitHub Commit). All users running Chamilo LMS ≤1.11.28 should upgrade to version 1.11.30 immediately. As a temporary workaround for systems that cannot be upgraded, administrators can implement network-level controls (e.g., WAF rules) to block requests to help.php containing HTML characters in the open parameter, and should educate users to be cautious of unexpected links to the LMS.