CVE-2025-55208 — Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files

CVE-2025-55208

Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files PUBLISHED

Description (CNA)

Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account. Version 1.11.34 fixes the issue.

Affected (CNA)

Vendor / product	Versions
chamilo / chamilo-lms	affected < 1.11.34

CWE

CWE-79

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-2vq2-826h-6hp6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.