CVE-2026-82535

Executive Summary

CVE-2026-82535 is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS affecting versions before 1.11.42 and the 3.0.0 release, where unauthenticated attackers can inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Because the injected HTML is rendered unescaped in reporting views, arbitrary JavaScript executes in the browser sessions of teachers and administrators, enabling persistent backdoor account creation via the hijacked authenticated session. The CVSS v3.1 base score is 6.1 (Medium), reflecting network reachability, no privileges required, user interaction required, and scope change with low confidentiality and integrity impact; no public PoC, exploit code, or Nuclei template is currently available, and patching is unconfirmed at the time of writing.

Technical Analysis

The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting), specifically the stored (persistent) variant. According to the NVD description, the vulnerable attack surface is the survey submission endpoint of Chamilo LMS. Two distinct weaknesses are chained:

1. Weak access control on survey submission. The survey submission endpoint enforces authorization by means of an invitation code. The description states these codes are deterministic, meaning an unauthenticated attacker can compute a valid code rather than obtaining it through a legitimate invitation. This effectively removes the authentication/authorization barrier that normally gates survey answer submission, allowing an unauthenticated actor to submit answers.

2. Missing output encoding of submitted answer content. Answer content containing HTML is not escaped before being rendered in reporting views. When a teacher or administrator later opens the reporting view that displays the collected survey answers, the injected markup is interpreted by the browser as active content, executing script in the context of that privileged user's session.

The scope-change (S:C) metric in the CVSS vector is consistent with XSS that crosses a trust boundary — script executing under the origin and session of a different, higher-privileged user than the attacker. The description explicitly notes that the end impact includes "persistent backdoor account creation by exploiting the victim's authenticated session," i.e., the XSS is used to perform state-changing actions as the victim (such as creating an attacker-controlled account), which maps to the low integrity and low confidentiality ratings.

No patch commit, vendor advisory, or concrete implementation detail (specific endpoint path, parameter name, or function name) is present in the provided data; the analysis above is limited strictly to the behavior described in the NVD entry. No public PoC, exploit code, or Nuclei template exists in the supplied dataset.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet-exposed Chamilo LMS instance running a version prior to 1.11.42 or 3.0.0. Because survey submission is reachable without authentication, the attacker needs no credentials to reach the vulnerable surface.

2. Authorization bypass via deterministic invitation code. The attacker computes a valid invitation code for a target survey. The description states the codes are deterministic; the attacker performs this computation offline and submits it with a survey response. This bypasses the authorization check that would otherwise restrict who may submit answers — the payload is submitted by a fully unauthenticated actor.

3. Payload injection. The attacker submits crafted survey answers containing unescaped HTML/script content. Because the answer content is not output-encoded, the payload is persisted in the survey data store and later emitted verbatim into reporting views.

4. Execution in the privileged session. When a teacher or administrator opens the survey reporting view, the stored script executes in their authenticated browser session (the user-interaction requirement reflected in CVSS UI:R). This grants the attacker script-level control of a privileged session.

5. Post-exploitation impact. Using the hijacked session, the attacker can act as the teacher/administrator — the NVD description specifically calls out persistent backdoor account creation. Additional plausible actions within the same class (persistent account creation, session abuse) follow from operating inside an authenticated privileged context; specific functions cannot be enumerated because no implementation detail is provided.

Impact Assessment

• Confidentiality (Low, C:L): Script execution in a privileged session can read data visible to that session; the CVSS rating is constrained to Low.
• Integrity (Low, I:L): The attacker can cause state changes as the victim — most notably creating backdoor accounts — as stated in the NVD description.
• Availability (None, A:N): No availability impact is described.
• Scope (Changed, S:C): The vulnerable component (survey submission) and the impacted component (privileged user session / reporting view) differ; the exploit crosses that boundary.
• Attack Vector (Network, AV:N) / Complexity (Low, AC:L) / Privileges (None, PR:N): Remotely exploitable at low complexity by an unauthenticated attacker.
• User Interaction (Required, UI:R): A teacher or administrator must open the affected reporting view for execution to occur.

Blast radius: Any organization running Chamilo LMS < 1.11.42 (or the affected 3.0.0 release) with surveys enabled on an internet-reachable deployment. Cascading risk is material because the injected script executes with teacher/administrator privileges, enabling account creation (persistent backdoor) that survives beyond the initial XSS. This is an inline (non-reflected) medium-severity XSS per vendor scoring conventions, but the privileged-session and persistent backdoor outcomes raise real-world severity above a typical self-XSS. No CISA KEV listing, no EPSS score, and no exploit-in-the-wild evidence are recorded in the provided data.

Detection Guidance

Sigma Rule

title: Chamilo LMS Survey Answer Stored XSS Injection Attempt
id: 9c1b7d2e-4f5a-4a8b-9c3d-82535cve2026
status: experimental
description: Detects POST submissions to Chamilo LMS survey endpoints carrying HTML/script payloads in answer fields, indicative of CVE-2026-82535 stored XSS injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82535
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/survey'
      - '/survey.php'
      - '/main/survey'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<img'
      - '<svg'
      - 'document.cookie'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Benign survey text containing literal HTML examples
level: high
tags:
  - attack.t1190
  - cve.2026-82535
  - cwe.79

YARA Rule

rule CVE_2026_82535_Chamilo_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Chamilo LMS survey reporting views (CVE-2026-82535)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82535"
        date = "2026-01-01"
        cve = "CVE-2026-82535"

    strings:
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "<svg/onload" ascii nocase
        $s7 = "Chamilo" ascii
        $survey = "survey" ascii nocase

    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x0A0D or $survey or
        ((1 of ($s1, $s2, $s3, $s4, $s5, $s6)) and $s7)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82535 Chamilo LMS Stored XSS Survey Answer Injection"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"survey"; nocase; http.client_body; content:"<script"; nocase; sid:202682535; rev:1; reference:cve,2026-82535; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82535; classtype:web-application-attack; metadata:affected_product Chamilo_LMS, attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      http.request.uri contains "survey" ]
  [ network where http.request.method == "POST" and
      (http.request.body contains "<script" or
       http.request.body contains "javascript:" or
       http.request.body contains "onerror=" or
       http.request.body contains "onload=") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND match(uri, "(?i)survey")
| where match(uri, "(?i)(<script|javascript:|onerror=|onload=|document\.cookie|<svg)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, useragent
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,chamilo,xss,">
  <rule id="100535" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31103</if_sid>
    <id>^POST$</id>
    <url>survey</url>
    <url>(&lt;script|javascript:|onerror=|onload=|document\.cookie)</url>
    <description>CVE-2026-82535: Possible Chamilo LMS stored XSS survey answer injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references "Chamilo LMS before 1.11.42 and 3.0.0"; no vendor fix, commit, or advisory has been confirmed in the provided data, and workarounds are listed as N/A.

1. Immediate mitigations (compensating controls):

   • Restrict access to survey submission and reporting endpoints to trusted networks / authenticated contexts via reverse proxy or WAF rules; block unauthenticated POSTs to survey endpoints where feasible.
   • Deploy input validation / HTML-sanitization rules at the WAF/edge to neutralize <script, event-handler attributes, and javascript: schemes in submitted survey answers.
   • Temporarily disable survey functionality if surveys are not operationally required, removing the attack surface entirely.
   • Enforce strict output encoding on any server-side rendering of user-supplied survey content; treat all stored answers as untrusted.
   • Apply least privilege to teacher/administrator roles and monitor for unexpected account creation (backdoor) activity in the authenticated session.

2. Patch/upgrade steps: Upgrade Chamilo LMS to 1.11.42 or later, or to a 3.0.0 build that contains the fix, once the vendor publishes confirmed patched releases. Because patch confidence is 0/4, verify the actual fixed version against the official Chamilo release/changelog before relying on it; do not assume the version strings alone constitute a verified fix. Track the NVD and Chamilo project channels for an official advisory.

3. Long-term hardening:

   • Adopt context-aware output encoding as a default across all reporting/rendering views (template auto-escaping).
   • Replace deterministic invitation codes with cryptographically random, single-use, server-validated tokens and bind them to the intended recipient/session.
   • Add a Content-Security-Policy that disallows inline script to reduce XSS impact.
   • Implement routine dependency tracking for LMS components and a coordinated vulnerability disclosure process.

References

1. NVD — CVE-2026-82535: https://nvd.nist.gov/vuln/detail/CVE-2026-82535
2. Chamilo LMS official project site / release notes: https://chamilo.org
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-82535 is NOT listed as of this report)

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no Nuclei template, and no recorded exploit code or in-the-wild campaign evidence for CVE-2026-82535 in the provided data. EPSS has not yet been scored by FIRST.org.