CVE-2025-66447: 
Chamilo vulnerability analysis and mitigation

CVE-2025-66447 is an open redirect vulnerability in Chamilo LMS that allows any unauthenticated attacker to trigger a malicious redirect by manipulating the redirect parameter on the /login endpoint. It affects Chamilo LMS versions from 1.11.0 through 2.0-beta.1 (inclusive), and was disclosed on April 10, 2026. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) and carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly, GitHub Advisory).

The root cause is a lack of validation on the redirect query parameter accepted by the /login page (CWE-601). Prior to the fix, the application passed the raw value of redirect directly to window.location.href and to backend redirect logic without verifying that the destination URL belonged to the same origin or was a relative path. The patch (commit 73ae629) introduces a normalizeRedirectUrl() function that enforces same-origin validation: root-relative paths are parsed and returned as path+query+hash only, while absolute URLs are validated for protocol and origin before use; any cross-origin or invalid value is rejected and falls back to /. The server-side ExceptionListener.php was also corrected to pass only $request->getRequestUri() (a relative path) rather than the full scheme-and-host-prefixed URL as the redirect parameter (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to redirect authenticated or unauthenticated users from a legitimate Chamilo LMS login page to an arbitrary external URL, facilitating phishing attacks, credential harvesting, or malware distribution. Because no authentication or special privileges are required, any user who clicks a crafted login link can be silently redirected to a malicious site. The integrity impact is low and there is no direct confidentiality or availability impact, but the social engineering potential in an educational LMS context — where users routinely follow login links — is significant (Feedly, GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66447. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by Stormshield and disclosed responsibly through GitHub's security advisory process (Feedly, GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Chamilo LMS instances running versions 1.11.0 through 2.0-beta.1 using search engines, Shodan, or Censys by fingerprinting the Chamilo login page.
2. Craft malicious URL: Construct a login URL with a malicious external destination in the redirect parameter, e.g., https://target-chamilo.example.com/login?redirect=https://attacker.example.com/phishing.
3. Deliver to victim: Distribute the crafted URL via phishing email, instant message, or social media, impersonating a legitimate Chamilo login link to the target institution's users.
4. Victim interaction: When the victim clicks the link and is presented with (or completes) the Chamilo login page, the application processes the unvalidated redirect parameter and issues an HTTP redirect to the attacker-controlled URL.
5. Achieve objective: The victim's browser lands on the attacker's site, which may mimic the Chamilo interface to harvest credentials, deliver malware, or conduct further social engineering (GitHub Advisory, GitHub Commit).

• Network: HTTP requests to /login with a redirect query parameter containing an absolute URL pointing to an external domain (e.g., GET /login?redirect=https%3A%2F%2Fattacker.example.com).
• Logs: Web server access logs showing repeated or automated requests to the /login endpoint with encoded external URLs in the redirect parameter; 302 redirect responses to non-Chamilo domains originating from the login page.
• User Reports: End-user reports of being unexpectedly redirected to unfamiliar or suspicious websites after clicking a Chamilo login link.

Upgrade Chamilo LMS to version 2.0-beta.2 or later, which restricts the redirect parameter to same-origin relative paths only (GitHub Advisory). As a workaround for installations that cannot immediately upgrade, administrators can apply commit 73ae629 manually, which patches assets/vue/components/Login.vue, assets/vue/composables/auth/login.js, and src/CoreBundle/EventListener/ExceptionListener.php to enforce same-origin redirect validation (GitHub Commit). Additionally, a web application firewall (WAF) rule blocking requests to /login where the redirect parameter contains an absolute URL with an external hostname can provide interim protection.

The vulnerability was reported by Stormshield and disclosed via GitHub's security advisory program on April 10, 2026. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory).