What is the CVSS score of CVE-2026-39878?

CVE-2026-39878 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Chamilo LMS are affected by CVE-2026-39878?

Chamilo LMS versions 1.11.38 and earlier contain a critical stored cross-site scripting vulnerability allowing unauthenticated attackers to inject persistent malicious code through the public…

How to fix or mitigate CVE-2026-39878?

Within 24 hours: Disable the public user registration form or restrict access to authenticated users only; audit all pending registration submissions for suspicious HTML/JavaScript payloads and delete any suspicious entries; restrict registration review permissions to the minimum set of administrators required. Within 7 days: Monitor the Chamilo vendor GitHub Security Advisory (GHSA-gcjp-f7jm-rrrg) and official Chamilo security announcements for patch release; audit administrator session logs from the vulnerability discovery date forward for unauthorized access patterns or suspicious activity; deploy restrictive Content Security Policy headers across all Chamilo pages to block inline script execution. Within 30 days: Apply the vendor security patch to Chamilo LMS immediately upon release; verify the patch resolves the vulnerability in a staging environment before production deployment; conduct a comprehensive forensic audit of all administrator account activity during the exposure window; restore public registration access only after patch validation.

Chamilo LMS CVE-2026-39878

EUVD-2026-46038 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 GitHub_M

XSS Chamilo Lms Chamilo

9.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Unauthenticated network injection (AV:N/PR:N/AC:L) but requires an admin to view the stored payload (UI:R); script escapes into the admin session (S:C) with high confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:16 vuln.today

CVE Published

Jul 20, 2026 - 17:08 cve.org

CRITICAL 9.3

DescriptionCVE.org

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

AnalysisAI

Stored cross-site scripting in Chamilo LMS 1.11.38 and earlier lets any unauthenticated attacker inject persistent JavaScript through the public user registration form, which then executes in an administrator's browser when they review registrations, enabling full admin account takeover. The flaw carries a CVSS 9.3 rating driven by its scope change and high confidentiality/integrity impact; no public exploit is identified at time of analysis, though the vendor GitHub Security Advisory (GHSA-gcjp-f7jm-rrrg) confirms the issue and a fix. Because the injection point is an anonymous, self-service form, mass or opportunistic abuse is realistic once a payload is planted.

Technical ContextAI

Chamilo LMS is a widely-used open-source PHP e-learning/course-management platform (CPE cpe:2.3:a:chamilo:chamilo-lms). The root cause is CWE-79 (improper neutralization of input during web page generation): user-supplied registration field data is stored without adequate output encoding and later rendered in a privileged administrative view. Because the malicious script runs inside the admin's authenticated session, the attacker inherits the admin's DOM context and session - the classic stored-XSS-to-privilege-escalation pattern, reflected in the CVSS scope change (S:C) where the vulnerable component (registration form) impacts a separate security authority (the admin session).

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS 1.11.40, which remediates the stored XSS in the registration form, as documented in advisory GHSA-gcjp-f7jm-rrrg (https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg). If an immediate upgrade is not possible, reduce exposure by disabling public self-registration so anonymous users cannot submit the affected form (trade-off: legitimate users must be provisioned manually or via another flow), and require administrators to avoid opening the user/registration admin views until patched. As additional compensating controls, deploy a WAF rule to block script-bearing payloads in registration field submissions and enforce a strict Content-Security-Policy that disallows inline script execution in the admin interface (trade-off: CSP may break legitimate inline scripts and needs testing). These are mitigations only - upgrading to 1.11.40 is the durable fix.