This vulnerability allows an authenticated low‑privilege user, such as a student, to embed arbitrary HTML content in private messages. The content is stored without server‑side sanitization and rendered as HTML in the recipient’s browser when the message is viewed. When an administrator receives such a crafted message, the malicious script executes automatically, allowing the attacker to steal session credentials or impersonate the administrator to carry out actions within the LMS. The flaw is a classic Stored XSS identified as CWE‑79 and can lead to confidentiality, integrity, and availability impacts for the affected administrator account.

The problem exists in Chamilo LMS versions 2.0.0 through at least 2.1.0. The vulnerability was introduced when message content was rendered in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig without sanitization. It is fixed in release 2.0.1 and in later versions. Only the Chamilo LMS product is affected.

The CVSS score of 9 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that, while the potential impact is severe, the likelihood of real‑world exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have an authenticated account with permission to send messages, which is a low privilege. The attack vector is client‑side; no additional user interaction such as clicking a link is needed beyond opening the existing inbox or message view. Thus an educator or administrator who regularly checks messages is at risk if a malicious message is received from a low‑privilege user.