Chamilo LMS 2.0.0 through 2.0.1 exposed the public user profile view endpoint for anonymous access. The application rendered six user‑editable fields – firstname, lastname, competences, openarea, teach, and diplomas – inside a template block that disabled automatic escaping. No sanitization was performed on input, allowing an attacker to store arbitrary HTML or JavaScript in any user profile. When another user, including an administrator, views the profile, the malicious content executes in the victim’s browser, enabling theft of session cookies, JWT tokens, or data from localStorage and potentially leading to account takeover. This flaw aligns with CWE‑79, a category of stored cross‑site scripting vulnerabilities.

The affected product is Chamilo Learning Management System, version 2.0.0 up to and including 2.0.1, as identified by the vendor Chamilo. An anonymous user can view the profile, and a user with a student role can write malicious content. The issue was corrected in the 2.0.1 release, so any deployment running these versions is susceptible.

The CVSS score for this vulnerability is 8.9, indicating a high severity. The EPSS score is not available, so the exact likelihood of exploitation in the current environment is uncertain, but the publicly discoverable functionality provides a straightforward attack vector that does not require privileged access or complex conditions. The vulnerability is not listed in CISA’s KEV catalog, yet the conditions for exploitation are minimal: an attacker can register a new student account or use an existing one, inject malicious script into their public profile, and have the payload run in the browsers of anyone who visits the profile page. The potential impact is significant, with possibilities of credential theft and privilege escalation on the system. Therefore, the risk remains high until the software is updated or otherwise mitigated.