CVE-2026-45143

Executive Summary

CVE-2026-45143 is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS 2.0.0 through at least 2.1.0. An authenticated low-privilege user (including a student) can send a crafted private message to an administrator; the message content is stored without server-side sanitization and rendered as HTML, executing in the administrator's browser upon opening the routine inbox or message view. Successful exploitation can expose session credentials or permit actions as the administrator, and the CVSS 3.1 score is 9.0 (Critical).

Technical Analysis

The vulnerability is a stored (persistent) cross-site scripting flaw (CWE-79) caused by the absence of server-side output sanitization. According to the NVD description, Chamilo LMS stores the Message.content field without server-side sanitization and renders it as HTML in two locations:

• assets/vue/views/message/MessageShow.vue
• public/main/template/default/message/view_message.html.twig

Because the content is rendered as HTML rather than escaped text, any markup or script embedded in a message body is interpreted by the recipient's browser as page content. The message creation flow permits the sender to select another user as the recipient. This means a low-privileged authenticated user can directly address crafted content to an administrator.

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) reflects:

• Attack Vector (N): exploitable remotely over the network.
• Attack Complexity (L): no special conditions are required once the attacker holds a valid low-privilege account.
• Privileges Required (L): the attacker needs only a standard authenticated account, such as a student account.
• User Interaction (R): the administrator must open the inbox or message view; the description explicitly states no link click is required because the routine inbox/message view triggers execution.
• Scope (C): a successful exploit impacts resources beyond the vulnerable component (the administrator session/browser context).
• Confidentiality/Integrity/Availability (H/H/H): full compromise of the impacted administrative context.

The key attack surface is the private messaging subsystem and the two rendering templates named above. Because output encoding is missing at render time, the flaw class is standard stored XSS. No public proof-of-concept, exploit code, or Nuclei template is available for this CVE, and the vendor/product fields are recorded as Unknown in the provided data. No specific payload strings or JavaScript function names are disclosed in the description, so the exact injection syntax is not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored XSS) and the details explicitly present in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Chamilo LMS instance running an affected version (2.0.0 through at least 2.1.0). This is a standard authenticated application with a login page; the attacker can self-register where enrollment is open or use any existing low-privilege (student) account.

2. Triggering the flaw class. With a valid low-privilege account, the attacker opens the private messaging feature and composes a new message. The message creation flow permits the sender to select another user as the recipient. The attacker selects an administrator account as the recipient and places crafted HTML/script content into the message body (Message.content). Because the server does not sanitize the content on storage, the malicious payload is persisted.

3. Payload / execution (vulnerability-class level). When the administrator opens their routine inbox or the message view, the stored content is rendered as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. The browser interprets the injected content as markup/script and executes it in the administrator's session context. Per the description, execution does not require a link click; merely viewing the message is sufficient. The exact JavaScript constructs used are not disclosed and are not invented here.

4. Post-exploitation impact. The executing script runs with the privileges of the administrator's browser session. Per the description, this can expose session credentials or permit actions as the administrator. This enables full account takeover of the administrative context: reading or modifying sensitive configuration, accessing user data, and performing any action an administrator is authorized to perform within the LMS.

The message-rendering behavior is the sole disclosed trigger; no other vulnerable endpoints are asserted.

Impact Assessment

CVE-2026-45143 carries a CVSS 3.1 base score of 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The scoring reflects high impact across all three CIA properties and a scope change, because the exploitation compromises the administrative user's session beyond the messaging component itself.

• Confidentiality (High): session credentials and administrative-visible data can be exposed.
• Integrity (High): an attacker can act as the administrator, modifying content and settings.
• Availability (High): administrative control can be abused to disrupt or disable the platform.
• Blast radius: any Chamilo LMS deployment running an affected version where students and administrators communicate via private messages. In educational environments, attacker supply (student accounts) is typically abundant and administrators are high-value targets.
• Business impact: administrative account takeover of an LMS can expose student and staff PII, allow manipulation of grades and course content, facilitate further lateral movement into integrated systems (SSO, SIS), and create regulatory exposure in jurisdictions with data-protection obligations.

Because exploitation requires only a low-privilege account and one administrator viewing a message, the effective barrier to entry is low. EPSS has not yet been scored by FIRST.org; no CISA KEV listing, public PoC, exploit code, or Nuclei template was identified at the time of writing.

Detection Guidance

Sigma Rule

title: Potential Chamilo LMS Stored XSS via Private Message Content
id: 8e1c9f2a-7b4d-4c3a-9f6e-2a5b8d1c0e77
status: experimental
description: Detects stored XSS payload patterns in Chamilo LMS private message submissions targeting Message.content rendering.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45143
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/message'
      - 'view_message'
  selection_payload:
    cs-body|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<svg'
      - '<iframe'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate use of formatting that includes script-like strings
  - Security testing by authorized personnel
level: high
tags:
  - attack.t1059.007
  - cve.2026.45143

YARA Rule

rule CVE_2026_45143_Chamilo_Stored_XSS
{
    meta:
        description = "Detects Chamilo LMS private message content containing stored XSS payload indicators (CVE-2026-45143)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45143"
        severity = "critical"

    strings:
        $s1 = "<script" ascii wide nocase
        $s2 = "onerror=" ascii wide nocase
        $s3 = "onload=" ascii wide nocase
        $s4 = "javascript:" ascii wide nocase
        $s5 = "<svg" ascii wide nocase
        $s6 = "<iframe" ascii wide nocase
        $msg = "Message.content" ascii wide
        $vue = "MessageShow.vue" ascii wide
        $twig = "view_message.html.twig" ascii wide

    condition:
        (any of ($s*)) and 1 of ($msg, $vue, $twig)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-45143 Chamilo LMS Stored XSS via Private Message"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"message"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror"; nocase; http.request_body; content:"onload"; nocase; classtype:web-application-attack; reference:cve,2026-45143; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-45143; sid:202645143; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ http where http.request.method == "POST" and
      stringContains(http.request.body, "<script") or
      stringContains(http.request.body, "onerror=") or
      stringContains(http.request.body, "onload=") or
      stringContains(http.request.body, "javascript:") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where (cs_method="POST")
| where match(cs_uri_stem, "(?i)message")
| where match(cs_body, "(?i)<script|onerror=|onload=|javascript:|<svg|<iframe")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, cs_uri_stem, cs_username
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,chamilo,">
  <rule id="202645143" level="12">
    <if_sid>31100</if_sid>
    <field name="url">message</field>
    <field name="body">(script|onerror=|onload=|javascript:|&lt;svg|&lt;iframe)</field>
    <description>CVE-2026-45143: Possible Chamilo LMS stored XSS payload in private message content.</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source; the CNA description references a fix in version 2.0.1, but this is not corroborated by any patch source tracked here).

1. Immediate mitigations

   • Apply strict server-side output encoding to Message.content before rendering so that user-supplied content is treated as text, not HTML. Because this is a stored XSS (CWE-79), sanitizing at the point of store and/or render neutralizes the flaw class.
   • Where feasible, deploy a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of any residual unsanitized markup.
   • Restrict or monitor private messaging between low-privilege accounts and administrator accounts until remediated.
   • Treat administrator sessions as high-risk: enforce short session lifetimes and re-authentication for sensitive actions.

2. Patch / upgrade steps

   • The CNA description states the vulnerability is fixed in 2.0.1. However, no patch evidence was found in any tracked source (Patch Sources: []; Vendor Fix: N/A; OSV Packages: N/A). Verify directly with the vendor and confirm the affected version range before upgrading.
   • Until a verified vendor fix is available, treat the platform as unpatched and prioritize the mitigations above.

3. Long-term hardening

   • Adopt a context-aware output-encoding policy across all templates, including .vue components and Twig templates, and enforce it in code review and CI.
   • Validate and sanitize all user-supplied content at the boundary of storage and render, favoring allowlist-based HTML sanitization for any field that must contain markup.
   • Implement CSP with script-src restrictions and HttpOnly/Secure session cookies to limit credential exposure in case of successful XSS.
   • Monitor and audit messaging flows for anomalous payloads using the detection rules above.

References

• NVD — CVE-2026-45143: https://nvd.nist.gov/vuln/detail/CVE-2026-45143
• Chamilo LMS project site / vendor advisory location: https://chamilo.org
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS: https://www.first.org/epss/ (not yet scored for this CVE at time of writing)
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed)

Threat actor campaigns / exploit-in-the-wild evidence: none identified in the provided data. No public PoC, exploit code, or Nuclei template was available, and the CVE is not present in CISA KEV. All exploitation details above are inferred from the disclosed vulnerability class.