Chamilo LMS EUVD-2026-82419

Requires an authenticated Chamilo LMS account of any privilege level, including a student (PR:L), and relies on the built-in private messaging feature that lets a sender choose an arbitrary recipient - enabling a low-privilege user to directly target an administrator. Exploitation succeeds only against affected versions 2.0.0 through at least 2.1.0 (fixed in 2.0.1) where Message.content is stored without server-side sanitization and rendered as raw HTML in MessageShow.vue and view_message.html.twig. The limiting factor is user interaction (UI:R): the payload fires only when the recipient opens their inbox or the message view - though no link click is needed, so normal inbox usage triggers it. There is no unauthenticated path; an account and the messaging feature being enabled are prerequisites.

This is a stored (persistent) cross-site scripting flaw (CWE-79) whose severity signals are strong but whose real-world urgency is moderate. The vendor CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) is well-supported by the source evidence: the fixed Twig template previously wrapped output in {% autoescape false %} and rendered {{ message.content }} (later shown in the diff as {{ message.content|raw }}) with no sanitization, and the patch adds a MessageNormalizer that runs Security::remove_XSS() on the content - confirming unsanitized HTML storage and rendering. The attack is genuinely dangerous because a low-privilege student can pick an administrator as the recipient, so the payload executes in a high-value session with no link click (UI:R is satisfied merely by the admin opening the routine inbox). Tempering the score: exploitation is not zero-interaction (the victim must open the message), requires an authenticated account (PR:L), and no EPSS score, CISA KEV entry, SSVC decision, or public POC is provided in the input - so there is no signal of active or automated exploitation. A:H in the vendor vector is somewhat aggressive for an XSS; impact is really confidentiality/integrity (session theft, admin actions) rather than direct availability loss. Net: a real and patchable priority for any Chamilo 2.x operator, but currently 'no public exploit identified,' so this is a proactive-patch situation rather than an emergency-response one.

A logged-in student composes a private message addressed to an administrator with a payload such as an image/script tag in the body; Chamilo stores it without sanitization. When the administrator opens their inbox or the message view, the script executes in the admin's authenticated browser context, allowing session/cookie theft or forged administrative actions. No public exploit code is identified in the provided data, but the exploit is trivial to construct given the confirmed unsanitized |raw render.