CVE-2026-82535 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS deployments, particularly those using survey features, should assess exposure and verify the effectiveness of current security controls. They should also review compensating controls for exposed systems and monitor reporting views for suspicious activity. Additionally, they should prioritize verifying exposure of Chamilo LMS survey features, especially in reporting views, and assess the effectiveness of current input

Why it matters

CVE-2026-82535 is a stored cross-site scripting vulnerability in Chamilo LMS that allows unauthenticated attackers to inject malicious script payloads into survey answers. Defenders should prioritize verifying exposure, assessing security controls, and monitoring for suspicious activity.

• Potential for arbitrary script execution in teacher or administrator browser sessions
• Risk of persistent backdoor account creation via exploited victim sessions
• Need for verification of input validation and output encoding controls
• Importance of monitoring reporting views for suspicious activity

Technical summary

The vulnerability allows unauthenticated attackers to inject malicious script payloads into survey answers, which are then rendered in reporting views. This can lead to arbitrary script execution in the browser sessions of teachers or administrators. The vulnerability is caused by a lack of proper input validation and output encoding in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML to execute arbitrary scripts. The vulnerability affects Chamilo LMS before 1.11.42 and 3.0.0.

Defensive priority

Defenders should prioritize verifying exposure of Chamilo LMS survey features, especially in reporting views, and assess the effectiveness of current input validation and output encoding controls.

Recommended defensive actions

• Verify Chamilo LMS version and apply patches if necessary
• Review survey feature configurations and input validation controls
• Monitor reporting views for suspicious activity
• Implement additional security measures such as output encoding and Content Security Policy
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. However, specific details on exploitation or victim impact are not provided, suggesting a need for further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.