CVE-2026-82535
Received Received - Intake

Stored XSS in Chamilo LMS Survey Answers

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-82535
EUVD
EUVD-2026-76159

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
chamilo chamilo_lms to 1.11.42 (exc)
chamilo chamilo_lms to 1.11.40 (inc)
chamilo chamilo_lms to 2.0.3 (inc)
chamilo chamilo_lms 1.11.42
chamilo chamilo_lms 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS versions before 1.11.42 and 3.0.0. Unauthenticated attackers can inject malicious scripts into survey answers by generating predictable invitation codes and bypassing authorization checks. When viewed in reporting interfaces, the unescaped HTML executes in the browsers of teachers or administrators, potentially allowing persistent backdoor account creation through the victim's authenticated session.

Detection Guidance

Check for unauthorized survey submissions or reports containing unescaped HTML in Chamilo LMS versions 1.11.0 to 1.11.40 and 2.0.0 to 2.0.3. Inspect survey answer fields in reporting interfaces for suspicious scripts or payloads. Verify if invitation codes are properly validated and tied to user sessions.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary scripts in the browsers of teachers or administrators viewing survey reports. This could lead to session hijacking, unauthorized account creation, or further compromise of the Chamilo LMS system. Users with elevated privileges are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, unauthorized modifications, or exposure of personal or health information, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade Chamilo LMS to version 1.11.42 or 3.0.0 or later. Apply patches from commits c9d2614, be45f2f, and bea9cbcf to enforce invitation code ownership and escape user inputs. Remove legacy survey.php and reporting.php files if using the Vue survey tool.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart