CVE-2026-39878
Received Received - Intake

Stored XSS in Chamilo LMS User Registration

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-39878
EUVD
EUVD-2026-46038

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
chamilo chamilo_lms 1.11.40
chamilo chamilo_lms to 1.11.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS versions 1.11.38 and earlier. It allows unauthenticated attackers to inject malicious JavaScript via the user registration form. When an administrator views the user list, the script executes, giving the attacker full administrative control over the platform.

Detection Guidance

Check if your Chamilo LMS version is 1.11.38 or earlier by running: grep -r '"version"' /path/to/chamilo/configuration. If self-registration is enabled, inspect user registration forms for improper input handling. Look for unescaped user-supplied data in HTML attributes or JavaScript execution in admin views.

Impact Analysis

An attacker could take over your Chamilo LMS admin account, gaining access to all user data, grades, course content, and the ability to create, modify, or delete accounts and courses. This requires self-registration to be enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Full admin access may result in data breaches or non-compliance with these regulations.

Mitigation Strategies

Update Chamilo LMS to version 1.11.40 or later immediately. If updating is not possible, apply htmlspecialchars() with ENT_QUOTES to user input in HTML attributes and strip null bytes from input before processing. Disable self-registration if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39878. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart