PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32893 chamilo CVE debrief

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Chamilo LMS prior to 2.0.0-RC.3. An attacker can execute arbitrary JavaScript in an authenticated teacher's browser via the exercise question list admin panel. The vulnerability is due to the pagination code merging all $_GET parameters via array_merge() and outputting the result via http_build_query() directly into HTML href attributes without htmlspecialchars() encoding.

Vendor
chamilo
Product
chamilo-lms
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-10
Original CVE updated
2026-10-26
Advisory published
2026-04-10
Advisory updated
2026-10-26

Who should care

Authenticated teachers and administrators of Chamilo LMS, especially those using versions prior to 2.0.0-RC.3, should assess their exposure and prioritize verification and potential upgrades.

Why it matters

CVE-2026-32893 is a Reflected Cross-Site Scripting (XSS) vulnerability in Chamilo LMS prior to 2.0.0-RC.3. Authenticated teachers' browsers are at risk of JavaScript execution. Assess exposure, prioritize verification of Chamilo LMS versions, and consider upgrades to mitigate risk.

  • Execution of arbitrary JavaScript in authenticated teachers' browsers
  • Potential for unauthorized actions within the LMS
  • Risk of credential theft or session hijacking
  • Need for verification of Chamilo LMS version and exposure

Technical summary

The vulnerability exists in the exercise question list admin panel of Chamilo LMS prior to 2.0.0-RC.3. The pagination code merges all $_GET parameters and outputs them into HTML href attributes without proper encoding, allowing for Reflected Cross-Site Scripting (XSS) attacks. This affects authenticated teachers' browsers, allowing an attacker to execute arbitrary JavaScript. The vulnerability is fixed in 2.0.0-RC.3, and defenders should assess exposure and prioritize verification of Chamilo LMS versions. The attack requires user interaction and can lead to unauthorized actions within the LMS.

Defensive priority

Authenticated teachers' browsers are at risk of JavaScript execution. Assess exposure and prioritize verification of Chamilo LMS versions, especially those prior to 2.0.0-RC.3.

Recommended defensive actions

  • Verify Chamilo LMS version and upgrade to 2.0.0-RC.3 or later if necessary
  • Review and adjust pagination code to use proper encoding
  • Monitor for suspicious activity on teacher accounts
  • Perform a thorough review of the LMS configuration and user accounts
  • Implement additional security measures such as Web Application Firewall (WAF) rules
  • Conduct regular security audits and penetration testing
  • Keep software and plugins up-to-date

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Patch information is available via GitHub commits and vendor advisories. The vulnerability exists in Chamilo LMS prior to 2.0.0-RC.3, affecting authenticated teachers' browsers. Evidence is limited, and defenders should verify Chamilo LMS versions and assess exposure. The pagination code merges all $_GET parameters and outputs them into HTML href attributes without proper encoding.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32893 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32893

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32893 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32893

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.