Chamilo LMSのソーシャルネットワークにアップロードされたファイルに、Stored Cross Site Scriptingの脆弱性が存在する

The impact of CVE-2025-55208 is severe. A successful exploit allows an attacker to inject malicious JavaScript code into the Chamilo LMS environment. This code executes within the context of the administrator's session, granting the attacker full control over the administrative interface. This includes the ability to modify user accounts, course content, system configurations, and potentially exfiltrate sensitive data. The attack vector is relatively simple: an attacker can upload a specially crafted file containing malicious JavaScript, which is then executed when the administrator views the file or interacts with the 'Social Networks' feature. This is a significant risk for organizations relying on Chamilo LMS for educational purposes, as it could compromise the integrity and confidentiality of their learning environment.

Educational institutions, training organizations, and any entity utilizing Chamilo LMS for online learning are at risk. Specifically, organizations with older, unpatched Chamilo LMS installations are particularly vulnerable. Shared hosting environments where multiple users have access to file upload functionalities also increase the risk surface.

• php: Examine uploaded files in the Social Networks directory for suspicious JavaScript code. Use grep to search for <script> tags or obfuscated JavaScript patterns.

grep -r '<script' /path/to/chamilo/socialnetworks/uploads

• generic web: Monitor access logs for requests containing unusual file extensions or parameters associated with file uploads. Look for POST requests to file upload endpoints with suspicious content-type headers. • generic web: Check response headers for signs of XSS payloads being reflected back to the user. Use browser developer tools to inspect network traffic and identify any unexpected JavaScript execution.

1. 2026-03-05Disclosure

   disclosure

1. 予約済み2025-08-08
2. 公開日2026-03-05
3. 更新日2026-03-06
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-55208 is to immediately upgrade Chamilo LMS to version 1.11.34 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions to trusted users and file types. Implement strict input validation and sanitization on all user-supplied data, particularly during file upload processes. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Chamilo LMS logs for suspicious activity, such as unusual file uploads or unexpected JavaScript execution. After upgrading, verify the fix by attempting to upload a test file containing a simple JavaScript payload and confirming that it is properly sanitized and does not execute.