Cross-site scripting in Chamilo LMS - CVE-2026-61655
Published: August 4, 2026
Vulnerability identifier: #VU140909
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-61655
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in the browser of another administrator and disclose session cookies.
The vulnerability exists due to cross-site scripting in the languages.php admin language management interface when rendering a user-controlled language name inside an HTML value attribute. A remote privileged user can inject a malicious language name containing double quotes to execute arbitrary JavaScript in the browser of another administrator and disclose session cookies.
User interaction is required because another administrator must view or edit the affected language entry.
Affected software
Chamilo LMS
How to mitigate CVE-2026-61655
Install security update from vendor's website.
Chamilo LMS - addressed in versions 1.11.40, 2.0.3