What is the CVSS score of CVE-2025-55208?

CVE-2025-55208 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2025-55208?

Chamilo LMS versions prior to 1.11.34 contain a critical stored cross-site scripting (XSS) vulnerability in the Social Networks feature that allows attackers to inject malicious code through file…

How to fix or mitigate CVE-2025-55208?

Within 24 hours: Identify all Chamilo instances and document current versions; disable the Social Networks feature if operationally feasible; review file upload logs for suspicious activity. Within 7 days: Implement WAF rules to block malicious payloads in file uploads; segment Chamilo infrastructure from sensitive systems; brief stakeholders on temporary restrictions. Within 30 days: Monitor vendor announcements for patch release; establish upgrade testing environment; execute vendor patching immediately upon availability.

Chamilo Lms CVE-2025-55208

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 security-advisories@github.com

XSS Chamilo Lms

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 21:16 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in Social Networks. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account. Version 1.11.34 fixes the issue.