CVE-2026-34161 (GCVE-0-2026-34161)

Vulnerability from cvelistv5 – Published: 2026-04-14 21:12 – Updated: 2026-04-16 13:49
VLAI
Title
Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution
Summary
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application's origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
chamilo chamilo-lms Affected: < 2.0.0-RC.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T13:49:14.409455Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T13:49:26.172Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "chamilo-lms",
          "vendor": "chamilo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0-RC.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application\u0027s origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-14T21:12:48.128Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3"
        }
      ],
      "source": {
        "advisory": "GHSA-273p-jw9w-3g22",
        "discovery": "UNKNOWN"
      },
      "title": "Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34161",
    "datePublished": "2026-04-14T21:12:48.128Z",
    "dateReserved": "2026-03-25T20:12:04.197Z",
    "dateUpdated": "2026-04-16T13:49:26.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34161",
      "date": "2026-08-04",
      "epss": "0.00219",
      "percentile": "0.12446"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34161\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-14T21:16:26.400\",\"lastModified\":\"2026-07-24T22:10:00.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application\u0027s origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.\"},{\"lang\":\"es\",\"value\":\"Chamilo LMS es un sistema de gesti\u00f3n de aprendizaje de c\u00f3digo abierto. En versiones anteriores a la 2.0.0-RC.3, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la funcionalidad de carga de archivos adjuntos de publicaciones sociales, donde un usuario autenticado puede cargar un archivo HTML malicioso que contiene JavaScript a trav\u00e9s del endpoint /API/social_post_attachments. El archivo cargado es servido de vuelta desde la aplicaci\u00f3n en la contentUrl generada sin saneamiento, restricciones de tipo de contenido, o una cabecera Content-Disposition: attachment, lo que provoca que el JavaScript se ejecute en el navegador dentro del origen de la aplicaci\u00f3n. Debido a que la carga \u00fatil se almacena en el lado del servidor y se ejecuta en el origen de confianza, un atacante puede realizar secuestro de sesi\u00f3n, toma de control de cuenta, escalada de privilegios (si un administrador ve el enlace), y acciones arbitrarias en nombre de la v\u00edctima. Este problema ha sido solucionado en la versi\u00f3n 2.0.0-RC.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"chamilo\",\"product\":\"chamilo-lms\",\"versions\":[{\"version\":\"\u003c 2.0.0-RC.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-16T13:49:14.409455Z\",\"id\":\"CVE-2026-34161\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.11.38\",\"matchCriteriaId\":\"34085140-9203-4B20-9036-743718F1A4F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AF7661F-C1F7-4CAB-BBDF-FC5BF7F5BEB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE56AF71-9D53-42C6-980D-09E1C418ED87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"01195674-9E1A-4C07-B7D3-0F0CC2E6511B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAE63449-5A56-4302-A4BF-F3D19FC96A80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A84A06F9-5AB7-4703-8153-33AC68882B95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B91302A3-53DE-4ED0-BAAB-FE9DA03F8242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"46008D4A-96F7-4E04-8256-E115AAAE3383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E2BCAFF-D44B-4E67-998A-DF855E27606B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2E7D018-E4C2-45F5-8D9A-DAC947173607\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAF96697-6B6D-459D-9510-E5CEEDC2859B\"}]}]}],\"references\":[{\"url\":\"https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-16T19:22:30+00:00",
      "cve": "CVE-2026-34161",
      "id": "CVE-2026-34161",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34161.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34161\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-16T13:49:14.409455Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-16T13:49:21.299Z\"}}], \"cna\": {\"title\": \"Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution\", \"source\": {\"advisory\": \"GHSA-273p-jw9w-3g22\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"chamilo\", \"product\": \"chamilo-lms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.0-RC.3\"}]}], \"references\": [{\"url\": \"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22\", \"name\": \"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f\", \"name\": \"https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da\", \"name\": \"https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\", \"name\": \"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application\u0027s origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-14T21:12:48.128Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34161\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-16T13:49:26.172Z\", \"dateReserved\": \"2026-03-25T20:12:04.197Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-14T21:12:48.128Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.