CVE-2026-82535

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/chamilo/chamilo-lms/commit/be45f2f2a29319afbbf9ce27d094698911799d10
https://github.com/chamilo/chamilo-lms/commit/bea9cbcfc6ca58f387c6c25bef2f15dc5df9d147
https://github.com/chamilo/chamilo-lms/commit/c9d2614d798571b94cef1cb61e605a2fc89f0386
https://github.com/chamilo/chamilo-lms/releases/tag/v3.0.0
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m3wr-p8wj-jmf6
https://www.vulncheck.com/advisories/chamilo-lms-stored-xss-via-survey-answer-submission-in-reporting-php

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-11 18:16

Updated : 2026-09-11 20:19

NVD link : CVE-2026-82535

Mitre link : CVE-2026-82535

CVE.ORG link : CVE-2026-82535

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-82535", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82535", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-11T19:21:14.253000Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/chamilo/chamilo-lms", "vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "1.11.0", "versionType": "semver", "lessThanOrEqual": "1.11.40"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.3"}, {"status": "unaffected", "version": "1.11.42", "versionType": "semver"}, {"status": "unaffected", "version": "3.0.0", "versionType": "semver"}], "packageURL": "pkg:github/chamilo/chamilo-lms", "defaultStatus": "unaffected"}]}], "published": "2026-09-11T18:16:59.290", "references": [{"url": "https://github.com/chamilo/chamilo-lms/commit/be45f2f2a29319afbbf9ce27d094698911799d10", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/chamilo/chamilo-lms/commit/bea9cbcfc6ca58f387c6c25bef2f15dc5df9d147", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/chamilo/chamilo-lms/commit/c9d2614d798571b94cef1cb61e605a2fc89f0386", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v3.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m3wr-p8wj-jmf6", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/chamilo-lms-stored-xss-via-survey-answer-submission-in-reporting-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session."}], "lastModified": "2026-09-11T20:19:15.857", "sourceIdentifier": "disclosure@vulncheck.com"}