CVE-2026-45143— Chamilo LMS: Student-to-admin stored XSS in private messages via v-html
Quick assessment
Affected
chamilo chamilo-lms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Chamilo LMS 是一个开源学习管理系统。从 2.0.0 到至少 2.1.0 版本，Chamilo LMS 在存储私密消息的 字段时未进行服务器端净化（sanitization），并在 和 中将其作为 HTML 内容直接渲染。 经过身份验证的低权限用户（包括普通学生）可以利用该漏洞，向管理员发送精心构造的消息内容，因为消息创建流程允许发送者选择其他用户（如管理员）作为接收者。当管理员打开常规收件箱或查看具体消息时，该内容会在其浏览器中执行，无需点击任何链接。这可能导致会话凭据泄露，或允许攻击者以管理员身份执行
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45143
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chamilo LMS: Student-to-admin stored XSS in private messages via v-html
Source: CVE Program / CVE List V5
Vulnerability Description
Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. An authenticated low-privilege user, including a student, can directly address crafted message content to an administrator because the message creation flow permits a sender to select another user as the recipient. The content executes in the recipient's browser when the recipient opens the routine inbox or message view, without requiring a link click, and can expose session credentials or permit actions as the administrator. This vulnerability is fixed in 2.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| chamilo | chamilo-lms | >= 2.0.0, < 2.0.1 | - |
|
II. Public POCs for CVE-2026-45143
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45143
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45143 (1)
Vendor Advisories for CVE-2026-45143 (1)
Vendor Pages for CVE-2026-45143 (1)
-
🔗 Release v2.0.1 · chamilo/chamilo-lms · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: chamilo-lms
-
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remot -
CVE-2026-82535
Chamilo LMS Stored XSS via Survey Answer Submission in repor -
CVE-2026-34239
Chamilo Authenticated Remote Code Execution -
CVE-2026-39878
Chamilo stored XSS via user registration leads to admin acco -
CVE-2026-40291
Chamilo LMS has Privilege Escalation via API User Role Modif
Same vendor: chamilo
-
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remot -
CVE-2026-82535
Chamilo LMS Stored XSS via Survey Answer Submission in repor -
CVE-2026-34239
Chamilo Authenticated Remote Code Execution -
CVE-2026-39878
Chamilo stored XSS via user registration leads to admin acco -
CVE-2026-40291
Chamilo LMS has Privilege Escalation via API User Role Modif
Same weakness: CWE-79
V. Comments for CVE-2026-45143
No comments yet