Description
A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.
Published: 2026-10-18
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

Chamilo LMS incorporates a flaw in the TicketModule's addProject function where an attacker can pass a crafted Name value that is rendered in a browser without proper sanitisation, resulting in a cross‑site scripting vulnerability. This flaw aligns with CWE‑79 (XSS) and CWE‑94 (Code Injection), exposing the application to client‑side script execution that can be used to steal cookies, deface content, or perform arbitrary actions on the victim’s behalf.

Affected Systems

Affected versions are Chamilo LMS up to 1.11.40, 2.0.3, and 3.0.1. The Ticket Module's addProject endpoint is vulnerable in any of these releases. Systems running the mentioned versions should verify whether the vulnerable code path is present and apply the available patch.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, and no EPSS data is available, suggesting limited knowledge of current exploitation activity. The vulnerability is not listed in CISA's KEV catalog, yet an exploit has been publicly disclosed and can be accessed remotely. Publicly exposed installations that have not applied the patch are at increased risk, as attackers can trigger the XSS without special conditions.

Generated by OpenCVE AI on October 19, 2026 at 00:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chamilo LMS to the latest patched release that incorporates the commit cb6fe2127e587603451c609b4ed78c0293fcc3fa, which sanitises the Name parameter.
  • If an immediate upgrade is not feasible, restrict access to the TicketManager::addProject endpoint to authenticated users only and ensure that any Name inputs are HTML‑escaped before output.
  • Implement general input validation in the Ticket Module to reject or properly encode characters that could form executable scripts, thereby mitigating CWE‑79 and preventing dynamic code evaluation associated with CWE‑94.

Generated by OpenCVE AI on October 19, 2026 at 00:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 18 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.
Title Chamilo LMS Ticket TicketManager.php addProject cross site scripting
First Time appeared Chamilo
Chamilo lms
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:chamilo:lms:*:*:*:*:*:*:*:*
Vendors & Products Chamilo
Chamilo lms
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Chamilo Lms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T16:26:25.422Z

Reserved: 2026-10-18T07:56:11.039Z

Link: CVE-2026-112031

cve-icon Vulnrichment

Updated: 2026-10-19T16:26:15.673Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T00:16:31.587

Modified: 2026-10-19T17:17:08.257

Link: CVE-2026-112031

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T09:30:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')