CVE-2025-50186: Chamilo LMS Stored XSS Vulnerability

CVE-2025-50186 Overview

CVE-2025-50186 is a stored cross-site scripting (XSS) vulnerability affecting Chamilo, an open-source learning management system (LMS). The vulnerability exists due to insufficient sanitization of CSV filenames during the user import process. An attacker with sufficient privileges can upload a maliciously named CSV file containing JavaScript code that executes when administrators or other users view import logs or file listings.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of administrative users, potentially leading to session hijacking, privilege escalation, or data theft within the learning management system.

Affected Products

Chamilo LMS versions prior to 1.11.30
chamilo chamilo_lms

Discovery Timeline

2026-03-02 - CVE-2025-50186 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-50186

Vulnerability Analysis

This stored XSS vulnerability originates from the user import functionality in Chamilo LMS. The application fails to properly sanitize filenames of uploaded CSV files before storing and displaying them. When an attacker uploads a file with a crafted filename containing malicious HTML/JavaScript (e.g., <img src=q onerror=prompt(8)>.csv), the unsanitized filename is stored and later rendered in the browser without proper encoding.

The attack requires the attacker to have privileges to upload CSV files through the user import feature. However, once uploaded, the malicious payload persists in the system and executes whenever an administrator or privileged user accesses the import logs or file views where the filename is displayed.

Root Cause

The root cause is the lack of input sanitization on the $_FILES['import_file']['name'] parameter in the main/admin/user_import.php file. The original code directly used the user-supplied filename without any dangerous character replacement or HTML encoding, allowing script injection through the filename itself.

Attack Vector

The attack vector is network-based and requires user interaction. An authenticated attacker with file upload privileges can:

Craft a CSV file with a malicious filename containing JavaScript payload
Upload the file through the user import functionality
The malicious filename is stored without sanitization
When an administrator views the import logs or file listings, the JavaScript payload executes in their browser context

php

// Vulnerable code path (pre-patch)
            $targetFolder = api_get_configuration_value('root_sys').'app/cache/backup/import_users';
            $targetFolder .= DIRECTORY_SEPARATOR.$userId.DIRECTORY_SEPARATOR.$today;
            $targetFolder = createDirectory($targetFolder).DIRECTORY_SEPARATOR;
-            $originalFile = $targetFolder.$_FILES['import_file']['name'];
+            $cleanFileName = api_replace_dangerous_char($_FILES['import_file']['name']);
+            $cleanFileName = disable_dangerous_file($cleanFileName);
+            $originalFile = $targetFolder.$cleanFileName;
            // save original file
            if (!file_exists($originalFile)) {
                touch($originalFile);

Source: GitHub Commit Details

Detection Methods for CVE-2025-50186

Indicators of Compromise

Uploaded CSV files with suspicious filenames containing HTML tags, JavaScript event handlers, or special characters (e.g., <, >, onerror, onload, script)
Web server access logs showing file uploads with encoded special characters in the filename parameter
Unusual administrator account activity following file import operations

Detection Strategies

Implement web application firewall (WAF) rules to detect and block file uploads with filenames containing HTML/JavaScript patterns
Monitor Chamilo application logs for file import operations with suspicious filename patterns
Review stored files in app/cache/backup/import_users directories for malicious filename indicators

Monitoring Recommendations

Enable detailed logging for the user import functionality in Chamilo LMS
Set up alerts for file upload operations containing special characters in filenames
Regularly audit administrator session activity for signs of session hijacking following import operations

How to Mitigate CVE-2025-50186

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.30 or later immediately
Review existing uploaded files in the app/cache/backup/import_users directory for suspicious filenames
Implement Content Security Policy (CSP) headers to mitigate XSS impact
Consider temporarily restricting access to the user import functionality until the patch is applied

Patch Information

The vulnerability has been patched in Chamilo LMS version 1.11.30. The fix implements proper filename sanitization using the api_replace_dangerous_char() and disable_dangerous_file() functions before storing uploaded files. Organizations should upgrade to version 1.11.30 or later. For detailed patch information, see the GitHub Security Advisory GHSA-wrx6-5v5r-mmgx and GitHub Release v1.11.30.

Workarounds

Restrict access to the user import functionality to only trusted administrators
Implement server-side filename validation that strips or rejects files with special characters before processing
Deploy a web application firewall with rules to filter malicious filenames in file upload requests

bash

# Configuration example - Apache mod_security rule to block suspicious filenames
SecRule FILES_NAMES "@rx <[^>]*>" "id:1001,phase:2,deny,status:403,msg:'XSS in filename detected'"