Chamilo LMS CVE-2026-112031

Exploitation requires an authenticated account with privilege to create or edit ticket projects in the Chamilo Ticket Module (the TicketManager::addProject path), into whose Name field an attacker injects a stored script payload. Triggering is gated by victim interaction (CVSS UI:P): a second user must load the page that renders the stored project name before the payload fires. Limiting factors that reduce real-world risk: it is not usable by fully unauthenticated attackers (PR:L), the injected content must be viewed by a victim rather than executing automatically, and only Chamilo LMS versions up to 1.11.40/2.0.3/3.0.1 are affected - patched builds applying the htmlspecialchars/DOMParser output encoding from PR #9228 are not exploitable.

This is a stored cross-site scripting flaw (CWE-79) in Chamilo LMS, and the combined signals point to a moderate, bounded risk rather than a critical one. The only CVSS data provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P, base 5.1): network vector and low attack complexity, but it explicitly requires existing privileges (PR:L) and passive victim interaction (UI:P), and the impact is limited to low integrity (VI:L) with no confidentiality or availability impact - consistent with a self/stored XSS whose payload runs in another user's browser. The E:P exploit-maturity flag and the description ('exploit has been publicly disclosed') indicate publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active, widespread exploitation. Net: a real, patchable issue worth remediating, but the authentication requirement and need for a victim to view the injected content make it a targeted/post-authentication concern rather than a mass-exploitable emergency. One caveat to verify: the vendor PR (#9228) hardens many sinks (forum thread list, ticket settings view, course categories, user information, social friend list) with htmlspecialchars/DOMParser, while the CVE text pins the flaw to TicketManager::addProject's Name argument - the disclosed fix is broader than the single described sink, so the precise injection path should be confirmed against the advisory GHSA-wj7h-p8jp-jqxw.

An authenticated user with access to the Ticket Module creates a ticket project and embeds a JavaScript payload (e.g. an <img onerror=...> handler) in the project Name field, which is stored unsanitized. When an administrator or another user later loads the page that renders that project name, the script executes in their browser session. Public exploit code for this XSS has been disclosed, lowering the effort required to reproduce it.