EUVD-2026-21534Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the id_session parameter to the attacker's server. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
AnalysisAI
Open Redirect in Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 allows unauthenticated remote attackers to redirect authenticated administrators to arbitrary external URLs via a malicious redirect parameter on the session course edit page, while simultaneously leaking the id_session parameter to attacker-controlled servers. The vulnerability requires user interaction (UI:R) but affects confidentiality through session parameter disclosure and crosses trust boundaries (S:C), resulting in CVSS 4.7 with low real-world risk due to authentication and user-interaction requirements.
Technical ContextAI
This is a classic Open Redirect vulnerability (CWE-601) in a web application parameter validation flaw. Chamilo LMS is a learning management system built on web technologies that handles session management and administrative course editing functionality. The vulnerability exists in the session course edit page endpoint where user-supplied redirect parameters are not properly validated before being used in HTTP redirects. When an administrator saves coach assignment changes, the application constructs a redirect URL without sanitizing or allowlisting the destination, allowing attackers to inject arbitrary URLs. The id_session parameter, which likely contains or represents a session identifier, is passed as a query parameter and exposed to the attacker's domain during the redirect, creating an information disclosure channel. The vulnerability requires the attacker to socially engineer an authenticated administrator into clicking a crafted link, making it a client-side attack vector dependent on user context awareness.
RemediationAI
Vendor-released patch: upgrade to Chamilo LMS 1.11.38 or 2.0.0-RC.3 or later. Organizations running 1.11.x branches should prioritize upgrading to 1.11.38, while those on 2.0.x development branches should update to 2.0.0-RC.3 or the corresponding stable release once available. As an interim mitigation pending patch deployment, restrict administrator access to the session course edit functionality through network controls or administrative access policies, and educate administrators to avoid clicking external redirect links from untrusted sources. The upstream fixes are available in the referenced GitHub commits and should be reviewed for any custom deployments requiring manual patching. See the security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-q2cp-3qj3-wx8q for additional details.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today