CVE Explorer

CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment he

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:5997b8c81079e97916823b098886880b02b849cbb4c09e334530066430b457ae

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"chamilo-lms","vendor":"chamilo","versions":[{"status":"affected","version":"< 2.0.0-RC.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions

{"name":"https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/references/1

{"name":"https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7da"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/references/2

{"name":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3","tags":["x_refsource_MISC"],"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/references/3

{"name":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6ab260fbd79ed9d102ae3910a5cd6868a943734e20537dbd57d8172d9d9a7f03 · sha256:9835776057b41fc0… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer