Chamilo Lms EUVD-2026-22714

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) indicates moderate real-world risk: the attack requires network access (AV:N), low attack complexity (AC:L), authentication (PR:L), and user interaction (UI:P). The score of 5.1 reflects limited confidentiality and integrity impact on the vulnerable component itself, but this underrepresents the actual risk when considering the attack's privilege escalation potential and session hijacking capabilities. Exploitation requires an authenticated attacker to craft and upload a malicious HTML file, then socially engineer a victim (including potentially privileged users like administrators) to click the resulting contentUrl. No public exploit code has been identified at time of analysis. The fact that this is a stored vulnerability significantly elevates real-world risk compared to reflected XSS, as the payload persists for all subsequent viewers. The requirement for user interaction (UI:P) is the primary mitigating factor; however, within a collaborative learning platform like Chamilo LMS where users regularly share social posts, this interaction is highly probable. The vulnerability affects all versions prior to 2.0.0-RC.3 with no identified workarounds, making patching the only reliable mitigation.

An authenticated attacker creates a malicious HTML file containing JavaScript that steals session cookies or performs administrative actions (e.g., creating unauthorized user accounts). The attacker uploads this file via the social post attachment API and shares the generated contentUrl with other users, such as administrators. When an administrator clicks the link to view the attachment, the JavaScript executes in their browser within the Chamilo application's origin, allowing the attacker to hijack the admin session and escalate their own account privileges or access sensitive course data. No user interaction beyond clicking the link is required for the JavaScript to execute.