Stored XSS via user registration in Chamilo LMS (CVE-2026-39878)

A stored cross-site scripting vulnerability in the user registration form of Chamilo LMS allows any unauthenticated attacker to inject arbitrary JavaScript that executes in an administrator's browser session. The vulnerability stems from insufficient output encoding when user-supplied first/last name values are placed in HTML attributes, combined with null byte insertion bypassing input sanitization. Successful exploitation leads to full platform administrator account takeover, exposing all user data, grades, and course content. Affected versions: - <= 1.11.38 We recommend updating to: 1.11.40. CVSS 9.3 · our assessment: act_now Reference: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg Details: https://vuln.today/cve/CVE-2026-39878