CVE-2025-59542: XSS in Chamilo LMS

The impact of CVE-2025-59542 is significant. An attacker with a low-privileged account, such as a trainer, can exploit this vulnerability to inject malicious JavaScript into the course learning path Settings field. When other users, including administrators, view the course information page, the injected script executes in their context. This allows the attacker to steal sensitive session cookies or tokens, effectively enabling account takeover (ATO) of higher-privileged accounts. The potential for unauthorized access to sensitive data and system control makes this a critical security risk. Successful exploitation could lead to data breaches, system compromise, and disruption of learning activities.

1. Reserved2025-09-17
2. Published2026-03-06
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59542 is to upgrade Chamilo LMS to version 1.11.34 or later. Before upgrading, it's crucial to back up your Chamilo LMS installation to allow for rollback if issues arise. While a direct fix is available through upgrading, consider implementing input validation and output encoding on user-supplied data within the learning path settings to further reduce the attack surface. Monitor web application firewalls (WAFs) for suspicious JavaScript injection attempts targeting the course learning path settings endpoint. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the course learning path Settings field and verifying that it does not execute.