A stored cross‑site scripting flaw exists in the social post attachment upload feature of Chamilo LMS. When an authenticated user uploads a malicious HTML file to the /api/social_post_attachments endpoint, the application serves the file from the generated contentUrl without any sanitization, content type restrictions, or an attachment header. The JavaScript within the file executes in the victim’s browser as part of the trusted application origin, allowing the attacker to hijack sessions, take over accounts, upgrade privileges if an administrator views the link, and carry out arbitrary actions on behalf of the victim.

The vulnerability affects all Chamilo Learning Management System installations running a version earlier than 2.0.0‑RC.3, including production deployments where user‑generated attachments are enabled. The issue has been addressed in version 2.0.0‑RC.3 and later.

The CVSS score is 5.1, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with permission to upload attachments; the attacker must then lure an administrator or another privileged user to the malicious attachment’s URL for the cross‑site scripting payload to execute. Because the vulnerable code runs on the trusted server origin, the impact can be extensive if an admin accesses the link.