---
id: CVE-2026-45144
title: 'Chamilo LMS: Stored XSS in public user-profile fields'
summary: >-
  Chamilo LMS is an open-source learning management system. From 2.0.0 until
  2.0.1, `GET /user/{username}` is anonymously reachable and renders six
  user-editable profile fields (`firstname`, `lastname`, `competences`,
  `openarea`, `teach`, …
severity: high
cvss: 8.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-79
vendor: chamilo
product: chamilo-lms
affected:
  - 'chamilo-lms >= 2.0.0, < 2.0.1'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T22:38:54.269203Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:40:09.197Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45144'
references:
  - url: >-
      https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm
    label: >-
      https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm
  - url: >-
      https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0c35057
    label: >-
      https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0c35057
  - url: 'https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1'
    label: 'https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1'
tags:
  - cve.org
epss: 0.00229
epssPercentile: 0.1379
ingestedAt: '2026-11-05T21:36:00.655Z'
---

## Overview

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.

## Affected

- `chamilo-lms >= 2.0.0, < 2.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.