Is there a patch available for CVE-2026-34161?

Yes, a patch is available for CVE-2026-34161. Update the affected software to the latest version immediately.

Chamilo Lms CVE-2026-34161

Q: What is the CVSS score of CVE-2026-34161?

CVE-2026-34161 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22714 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 GitHub_M

Privilege Escalation XSS Chamilo Lms

5.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:57 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3

Analysis Generated

Apr 14, 2026 - 22:43 vuln.today

CVSS changed

Apr 14, 2026 - 21:22 NVD

5.1 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 21:16 euvd

EUVD-2026-22714

Analysis Generated

Apr 14, 2026 - 21:16 vuln.today

CVE Published

Apr 14, 2026 - 21:12 nvd

MEDIUM 5.1

DescriptionGitHub Advisory

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application's origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.

AnalysisAI

Stored cross-site scripting (XSS) in Chamilo LMS versions prior to 2.0.0-RC.3 allows authenticated users to upload malicious HTML files containing JavaScript via the social post attachment API endpoint. The uploaded files are served without sanitization, content-type restrictions, or proper content-disposition headers, causing embedded JavaScript to execute in the browser within the application's trusted origin. This enables session hijacking, account takeover, and privilege escalation attacks, particularly when an administrator views a malicious link. The vulnerability is confirmed fixed in version 2.0.0-RC.3.

Technical ContextAI

This is a stored XSS vulnerability (CWE-79) affecting Chamilo LMS's REST API endpoint /api/social_post_attachments. The root cause stems from insufficient input validation and output encoding in the file upload and serving mechanism. When a user uploads a file through the attachment endpoint, the application generates a contentUrl to serve the file back to users. The vulnerability arises because the server fails to enforce three critical security controls: (1) content-type validation to restrict file uploads to non-executable types, (2) content sanitization or encoding of file contents before serving, and (3) a Content-Disposition: attachment HTTP response header that would force browsers to download the file rather than execute it inline. Because the malicious JavaScript executes within the application's same origin (same scheme, domain, and port), it gains access to session cookies, CSRF tokens, and other sensitive data that would normally be protected by the browser's same-origin policy. This is particularly dangerous for privilege escalation when administrators or high-privilege users view links containing the malicious payload.

RemediationAI

The vendor-released patch is available in Chamilo LMS version 2.0.0-RC.3 or later. Administrators should upgrade immediately to this version or newer to apply the fix. The patch implements proper content-type validation for uploaded files, sanitizes or encodes file contents before serving, and adds appropriate Content-Disposition headers to prevent inline execution. Upgrade instructions and release details are available at https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3. No reliable workarounds exist for earlier versions; patching is the primary remediation. In the interim, administrators may consider restricting upload functionality through access controls or temporarily disabling the social post attachment feature if operationally feasible.