Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck

CVE-2026-82535Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php

Medium 6.1

In plain English

A medium-severity cross-site scripting in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	1.11.0 – through 1.11.402.0.0 – through 2.0.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-m3wr-p8wj-jmf6) vendor-advisory
Chamilo LMS v3.0.0 Release Notes release-notes
Patch Commit (3.0.x) patch
Patch Commit (1.11.x) patch
Patch Commit (1.11.x) patch
https://www.vulncheck.com/advisories/chamilo-lms-stored-xss-via-survey-answer-submission-in-reporting-php third-party-advisory