Chamilo: Account Takeover via Stored XSS in Course Learning Paths

The impact of this XSS vulnerability is significant. An attacker, even with a low-privileged account like a trainer, can inject malicious JavaScript code into the course learning path Settings field. When other users, including administrators, view the course information page, the injected script executes in their browser context. This allows the attacker to steal sensitive session cookies or tokens, effectively enabling account takeover (ATO) of higher-privileged accounts. Successful ATO grants the attacker full administrative control over the Chamilo LMS instance, potentially leading to data breaches, system compromise, and disruption of learning activities. The potential for widespread impact across an organization's learning environment makes this vulnerability particularly concerning.

Organizations utilizing Chamilo LMS, particularly those with trainers or other low-privileged users who have the ability to modify course learning paths, are at risk. Environments with legacy Chamilo installations or those lacking robust security monitoring practices are especially vulnerable.

• php / web:

grep -r 'learning path Settings field' /var/www/html/chamilo/

• generic web:

curl -I 'https://your-chamilo-instance/course/view.php?id=123' | grep -i 'content-type: application/javascript'

• generic web:

curl 'https://your-chamilo-instance/course/view.php?id=123' | grep -o '<script.*?>.*?</script>'

1. 2026-03-06Disclosure

   disclosure

1. Reserviert2025-09-17
2. Veröffentlicht2026-03-06
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59542 is to upgrade Chamilo LMS to version 1.11.34 or later. Before upgrading, it's crucial to back up your Chamilo LMS database and configuration files to facilitate a rollback if necessary. While a direct fix is available through upgrading, consider implementing a Web Application Firewall (WAF) with XSS filtering rules as an interim measure to block malicious JavaScript payloads. Regularly review and sanitize user input within the learning path Settings field to reduce the attack surface. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the course learning path Settings field and verifying that it does not execute.