What is the CVSS score of CVE-2025-52468?

CVE-2025-52468 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2025-52468?

Chamilo LMS installations prior to version 1.11.30 are vulnerable to input validation attacks via CSV user import functionality, enabling potential unauthorized access or data manipulation.. A patch is available.

Is there a public PoC exploit available for CVE-2025-52468?

Yes, a public proof-of-concept exploit is available for CVE-2025-52468. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-52468?

Within 24 hours: Identify all Chamilo instances in your environment and document their current versions. Within 7 days: Apply vendor patch to upgrade all affected Chamilo installations to version 1.11.30 or later, prioritizing production systems. Within 30 days: Conduct security testing on patched systems and implement monitoring for suspicious CSV import activities.

Chamilo Lms CVE-2025-52468

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-02 security-advisories@github.com

XSS Chamilo Lms

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 03, 2026 - 18:23 vuln.today

Public exploit code

Patch released

Mar 03, 2026 - 18:23 nvd

Patch available

CVE Published

Mar 02, 2026 - 16:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30.

AnalysisAI

Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Chamilo Lms. Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. T

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.11.30.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.