CVE-2025-55208: Stored XSS in Chamilo LMS

The impact of CVE-2025-55208 is severe. A successful exploit allows an attacker to inject malicious JavaScript code into the Chamilo LMS environment. This code executes within the context of the administrator's session, granting the attacker full control over the administrative interface. This includes the ability to modify user accounts, course content, system configurations, and potentially exfiltrate sensitive data. The attack vector is relatively simple: an attacker can upload a specially crafted file containing malicious JavaScript, which is then executed when the administrator views the file or interacts with the 'Social Networks' feature. This is a significant risk for organizations relying on Chamilo LMS for educational purposes, as it could compromise the integrity and confidentiality of their learning environment.

1. Reserved2025-08-08
2. Published2026-03-05
3. Modified2026-03-06
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-55208 is to immediately upgrade Chamilo LMS to version 1.11.34 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions to trusted users and file types. Implement strict input validation and sanitization on all user-supplied data, particularly during file upload processes. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Chamilo LMS logs for suspicious activity, such as unusual file uploads or unexpected JavaScript execution. After upgrading, verify the fix by attempting to upload a test file containing a simple JavaScript payload and confirming that it is properly sanitized and does not execute.