CVE-2025-50186

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30.

• CWE-79

• https://github.com/chamilo/chamilo-lms/commit/9fef8f30b41d586cb4f4fc823906c16a12ae0ff4Patch
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wrx6-5v5r-mmgxExploit, Vendor Advisory

Published

Mar 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50180esm.sh is a no-build content delivery network (CDN) for web …7.5
• CVE-2025-50181urllib3 is a user-friendly HTTP client library for Python. P…6.1
• CVE-2025-50182urllib3 is a user-friendly HTTP client library for Python. S…6.1
• CVE-2025-50183OpenList Frontend is a UI component for OpenList. Prior to v…6.5
• CVE-2025-50184DbGate is cross-platform database manager. In versions 6.4.3…7.1
• CVE-2025-50185DbGate is cross-platform database manager. In versions 6.6.0…7
• CVE-2025-50187Chamilo is a learning management system. Prior to version 1.…9.8
• CVE-2025-50188Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50189Chamilo is a learning management system. Prior to version 1.…8.8
• CVE-2025-5019The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat…5.4
• CVE-2025-50190Chamilo is a learning management system. Prior to version 1.…9.8
• CVE-2025-50191Chamilo is a learning management system. Prior to version 1.…7.2