Chamilo LMS is an open-source learning management system.
CVE-2026-45144
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields (firstname, lastname, competences, openarea, teach, and diplomas) inside {% autoescape false %}, without server-side sanitization on the write path. A ROLESTUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or localStorage exfiltration. This issue is fixed in version 2.0.1.
Assessment
- CVSS
- 8.9 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 30 October 2026
- Last updated
- 4 November 2026
- Weakness
- CWE-79
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-45144