CVE-2026-45143: Chamilo LMS Stored XSS Enables Student-to-Admin Takeover

Executive Summary

Chamilo LMS has patched a critical stored cross-site scripting vulnerability, tracked as CVE-2026-45143 (CVSS 9.0), in its internal private messaging feature. From version 2.0.0 through at least 2.1.0, message content is stored without server-side sanitization and rendered directly as HTML — and because any user can address a message to any other user, including an administrator, a low-privilege student account can trigger script execution directly in an admin's browser.

The issue is fixed in Chamilo 2.0.1 (GitHub advisory GHSA-x88v-rg6r-vqq6).

Vulnerability Overview

Root Cause and Attack Chain

Chamilo's private messaging feature stores Message.content without server-side sanitization and renders it as raw HTML in two places: the Vue-based message view (MessageShow.vue) and the Twig-templated legacy view (view_message.html.twig).

The attack requires nothing more than a normal, authenticated low-privilege account:

1. A student (or any authenticated user) composes a private message containing crafted HTML/JavaScript.
2. Because Chamilo's message-creation flow allows a sender to freely select any other user as the recipient, the student addresses the message directly to an administrator.
3. When the admin opens their routine inbox or message view — no special link click or social engineering needed — the injected script executes in the admin's authenticated session.
4. The script can steal session credentials or perform actions with admin privileges, effectively escalating a student account into full administrative compromise.

This "no click required" property is what pushes the severity to critical: the victim doesn't need to be tricked into anything beyond normal use of their own inbox.

Impact

• Privilege escalation: any authenticated user, regardless of role, can compromise an administrator's session.
• Session/credential theft: injected script runs with the admin's cookies and CSRF context.
• Downstream compromise: from an admin session, an attacker can create accounts, alter grades, access student PII, or pivot further into the platform.

Remediation

1. Upgrade to Chamilo 2.0.1 or later, which introduces server-side message-content sanitization.
2. Until patched, consider restricting messaging permissions so low-privilege roles cannot freely address messages to administrator accounts.
3. Review message history for suspicious HTML/script payloads sent to admin or staff accounts during the exposure window.
4. Rotate admin session tokens and audit recent admin-session activity if the platform was running an affected version.

References

• NVD — CVE-2026-45143
• GitHub Security Advisory GHSA-x88v-rg6r-vqq6