CVE-2026-33736

In Chamilo LMS from 2.0.0 through at least 2.1.0, private Message.content is stored without server-side sanitization and rendered as HTML in MessageShow.vue and view_message.html.twig. An authenticated low-privilege user, including a student, can send crafted message content to an administrator, which executes in the recipient's browser when the inbox or message view is opened.

In Chamilo LMS prior to 2.0.1, an unauthenticated remote attacker can execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism.

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form. An unauthenticated attacker can execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover.

Chamilo LMS contains an OS Command Injection vulnerability in the file move function where user-controlled path values are passed directly into exec() shell commands without escapeshellarg(). Any authenticated user who is a teacher in a course can move a document and trigger arbitrary command execution as the web server user. The issue is fixed in versions 1.11.38 and 2.0.0-RC.3.

In Chamilo LMS prior to 2.0.1, career.lib.php and import_csv.php call PHP's native unserialize() on user_career.extra_data from the database without the allowed_classes: false option. An attacker able to write crafted serialized PHP objects can trigger POP gadget chains in Symfony, Doctrine, or Monolog components, leading to arbitrary OS command execution. The issue is fixed in version 2.0.1.

In Chamilo LMS from 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields inside {% autoescape false %} without server-side sanitization. A ROLE_STUDENT attacker can plant HTML in their profile that executes in the browser of any visitor, including administrators. The issue is fixed in version 2.0.1.

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, delete_gradebook_from_skill, save_profile, and delete_profile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check_token() validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval() calls in the vendored PEAR HTML_QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.