CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application's origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.

• CWE-79

• https://github.com/chamilo/chamilo-lms/commit/7c4965e48769d1d06413836429e386816a465c7fPatch
• https://github.com/chamilo/chamilo-lms/commit/da671d66a146887be3a16eabc5dcf0a92c55f7daPatch
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-273p-jw9w-3g22Vendor Advisory

Published

Apr 14, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34154Discourse is an open-source discussion platform. In versions…5.3
• CVE-2026-34155RAUC controls the update process on embedded Linux systems. …5.3
• CVE-2026-34156NocoBase is an AI-powered no-code/low-code platform for buil…9.9
• CVE-2026-34158Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34159llama.cpp is an inference of several LLM models in C/C++. Pr…9.8
• CVE-2026-34160Chamilo LMS is an open-source learning management system. In…8.6
• CVE-2026-34162FastGPT is an AI Agent building platform. Prior to version 4…10
• CVE-2026-34163FastGPT is an AI Agent building platform. Prior to version 4…7.7
• CVE-2026-34164Valtimo is an open-source business process automation platfo…4.9
• CVE-2026-34165go-git is an extensible git implementation library written i…5
• CVE-2026-34166LiquidJS is a Shopify / GitHub Pages compatible template eng…5.3
• CVE-2026-34167Coolify is an open-source and self-hostable tool for managin…5