What is the CVSS score of CVE-2025-59541?

CVE-2025-59541 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2025-59541?

Chamilo LMS versions prior to 1.11.34 contain a CSRF vulnerability that allows attackers to delete course projects without user authorization, potentially disrupting educational operations and…

How to fix or mitigate CVE-2025-59541?

Within 24 hours: Audit Chamilo deployment version and identify affected instances; notify stakeholders of the vulnerability. Within 7 days: Implement compensating controls (WAF rules blocking unauthorized project deletions, enforce SameSite cookie policies); consider disabling project functionality if risk is unacceptable. Within 30 days: Upgrade to Chamilo 1.11.34 or later when patch becomes available; conduct security review of CSRF protections across all LMS modules.

Chamilo Lms CVE-2025-59541

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-06 security-advisories@github.com

CSRF Chamilo Lms

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 04:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patched in version 1.11.34.

AnalysisAI

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Chamilo Lms. Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patche