What is the CVSS score of CVE-2026-32893?

CVE-2026-32893 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32893?

Yes, a patch is available for CVE-2026-32893. Update the affected software to the latest version immediately.

Chamilo Lms CVE-2026-32893

EUVD-2026-21525 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 GitHub_M

XSS Chamilo Lms

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3

EUVD ID Assigned

Apr 10, 2026 - 18:00 euvd

EUVD-2026-21525

Analysis Generated

Apr 10, 2026 - 18:00 vuln.today

CVE Published

Apr 10, 2026 - 17:42 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's browser. The pagination code merges all $_GET parameters via array_merge() and outputs the result via http_build_query() directly into HTML href attributes without htmlspecialchars() encoding. This vulnerability is fixed in 2.0.0-RC.3.

AnalysisAI

Reflected XSS in Chamilo LMS exercise admin panel allows authenticated teachers to be tricked into executing arbitrary JavaScript via malicious paginated URLs, affecting versions prior to 2.0.0-RC.3. An attacker can craft a weaponized link containing unencoded query parameters that bypass the pagination mechanism's improper output encoding, potentially leading to session hijacking, credential theft, or unauthorized administrative actions within the learning management system. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Chamilo LMS versions before 2.0.0-RC.3 contain a reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in the exercise question list administrative interface. The root cause stems from unsafe parameter handling in the pagination code: the application merges all HTTP GET parameters via PHP's array_merge() function and then outputs the merged parameters directly into HTML href attributes using http_build_query() without applying htmlspecialchars() encoding. This allows attacker-controlled query string values to break out of href attribute context and inject arbitrary HTML and JavaScript. The CPE cpe:2.3:a:chamilo:chamilo-lms:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of Chamilo LMS on the 2.x branch prior to the RC.3 release.

RemediationAI

Vendor-released patch: Chamilo LMS 2.0.0-RC.3 or later. Organizations should immediately upgrade to Chamilo LMS 2.0.0-RC.3 or a subsequent stable release (when available) to apply the fix demonstrated in commit 72bc403f89b1ebb73a139f8f6cf0478857592276, which adds proper htmlspecialchars() encoding to the pagination parameter output. Until patching is feasible, administrators should restrict access to the exercise admin panel to trusted staff only and monitor for suspicious pagination requests containing encoded HTML entities (e.g., %3C, %3E, %22) in query parameters. The fix is tracked in the GitHub Security Advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-37jh-g64j-88mc and the upstream commit is available for review at https://github.com/chamilo/chamilo-lms/commit/72bc403f89b1ebb73a139f8f6cf0478857592276.