CVE-2026-39878: 
Chamilo vulnerability analysis and mitigation

CVE-2026-39878 is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS versions 1.11.38 and earlier, affecting the user registration form. An unauthenticated attacker can inject arbitrary JavaScript that executes in an administrator's browser session, leading to full platform admin account takeover. The vulnerability was published on July 20, 2026, and was patched in version 1.11.40. It carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory).

The vulnerability (CWE-79) stems from two distinct code-level flaws in Chamilo LMS. First, in main/auth/inscription.php (line 453), the Security::remove_XSS() function (backed by HTMLPurifier) fails to escape double quotes in non-HTML text contexts, and null byte insertion bypasses event handler detection. Second, in main/admin/user_list.php (lines 472–475), user-supplied first and last names are placed directly into HTML alt and title attributes without htmlspecialchars() encoding. An unauthenticated attacker submits a crafted registration payload containing a null-byte-obfuscated XSS payload in the name fields; when an administrator views the user list as part of routine administration, the payload executes in their browser session. Self-registration must be enabled on the platform, which is a common default for educational LMS deployments (GitHub Advisory).

Successful exploitation grants an unauthenticated attacker full administrative control of the Chamilo LMS platform. This includes access to all user data, grades, and course content, as well as the ability to create, modify, or delete any accounts and courses. The scope change (S:C) in the CVSS score reflects that the impact extends beyond the vulnerable component itself, and the attacker may leverage admin functionality for further server-level compromise. Both confidentiality and integrity are rated High, as all platform data is exposed and modifiable (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been confirmed at this time, and the NVD SSVC assessment indicates exploitation status as "none." The EPSS score is approximately 0.0024 (0.24%), reflecting a currently low probability of near-term exploitation. The attack requires no privileges and only minimal user interaction (an admin visiting the user list), making it relatively easy to trigger once a malicious registration is submitted. The vulnerability is detectable by Qualys scanner (detection ID 5015647) (GitHub Advisory).

1. Reconnaissance: Identify Chamilo LMS instances running version 1.11.38 or earlier with self-registration enabled (a common educational deployment configuration). Tools like Shodan or Google dorks targeting Chamilo login pages can assist.
2. Craft malicious registration payload: Prepare a first or last name field containing a null-byte-obfuscated XSS payload designed to bypass HTMLPurifier's event handler detection (e.g., inserting a null byte \x00 within an event handler attribute string such as " onmouseover=alert(1) x=").
3. Submit registration: Submit the crafted registration form at main/auth/inscription.php as an unauthenticated user. The malicious payload is stored in the database without proper sanitization.
4. Wait for admin interaction: The XSS fires when any administrator navigates to the user list at main/admin/user_list.php, where the unsanitized name is rendered inside an alt or title HTML attribute.
5. Execute payload: The injected JavaScript executes in the administrator's browser session. A real-world payload would exfiltrate the admin's session cookie or CSRF token to an attacker-controlled server, enabling full account takeover (GitHub Advisory).

• Network: Outbound HTTP requests from an administrator's browser to an unexpected external domain shortly after visiting the Chamilo user list page; unusual POST requests to the registration endpoint (main/auth/inscription.php) containing encoded or null-byte-containing strings in name fields.
• Logs: Web server access logs showing registration submissions with anomalous characters (null bytes %00, encoded quotes, or event handler keywords like onerror, onmouseover) in first/last name parameters; admin session activity originating from unexpected IP addresses following user list page visits.
• File System: No direct file system artifacts expected for this XSS attack, but newly created admin accounts or modified admin credentials in the database may indicate post-exploitation activity.
• Application: Unexpected new administrator accounts, modified course or user data, or unauthorized configuration changes within the Chamilo LMS admin panel (GitHub Advisory).

Chamilo has released version 1.11.40 which patches this vulnerability; all users running version 1.11.38 or earlier should upgrade immediately. The fix involves applying htmlspecialchars() with ENT_QUOTES and UTF-8 encoding to user-supplied first and last names before rendering them in HTML attributes in main/admin/user_list.php (lines 472–475), and stripping null bytes from user input before passing to HTMLPurifier. As a temporary workaround, administrators can disable self-registration if it is not operationally required, which eliminates the unauthenticated attack vector. Additionally, a Content Security Policy (CSP) header can reduce the impact of XSS by restricting script execution sources (GitHub Advisory).

The vulnerability was discovered and reported by Louis Sanchez of Voke Cyber, who published a research write-up at https://vokecyber.com/research/cve-2026-39878-chamilo-lms-stored-xss. The Chamilo project maintainer (ywarnier) published the official GitHub Security Advisory on July 7, 2026. No significant broader media coverage or notable social media reactions have been identified beyond standard CVE aggregator coverage (GitHub Advisory).