CVE-2026-45143 chamilo CVE debrief

Who should care

Administrators and users of Chamilo LMS, particularly those with low-privilege accounts, should be aware of this vulnerability and take steps to mitigate it. Reviewing and updating to version 2.0.1 or later is recommended.

Why it matters

CVE-2026-45143 is a critical vulnerability in Chamilo LMS that allows an authenticated low-privilege user to craft message content that can execute in the browser of an administrator. This could lead to exposure of session credentials or allow actions as the administrator. The issue is fixed in version 2.0.1, and administrators should prioritize patching and updates to mitigate this vulnerability.

• Potential exposure of session credentials
• Possible actions as an administrator
• Verification of user input sanitization
• Prioritization of patching and updates

Technical summary

The Chamilo LMS is vulnerable to stored cross-site scripting (XSS) in the message content. An authenticated low-privilege user can craft message content that executes in the browser of an administrator when the message is viewed, potentially exposing session credentials or allowing actions as the administrator. The issue is fixed in version 2.0.1. The vulnerability allows for the execution of arbitrary JavaScript code in the context of the administrator's session, which could lead to unauthorized actions or data exposure. Administrators should review and update Chamilo LMS to version 2.0.1 or later to mitigate this vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and update Chamilo LMS to version 2.0.1 or later
• Restrict message content creation and editing to trusted users
• Monitor user activity and message content for suspicious behavior
• Implement additional security measures to protect against cross-site scripting attacks
• Verify user input sanitization for message content
• Prioritize patching and updates for Chamilo LMS
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the Chamilo LMS vulnerability. The vulnerability allows an authenticated low-privilege user to craft message content that can execute in the browser of an administrator when the message is viewed, potentially exposing session credentials or allowing actions as the administrator. The issue is fixed in version 2.0.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.