CVE-2025-52468: Chamilo LMS Stored XSS Vulnerability

CVE-2025-52468 Overview

CVE-2025-52468 is a stored Cross-Site Scripting (XSS) vulnerability affecting Chamilo, an open-source learning management system (LMS). The vulnerability exists in the user data import functionality when processing CSV files. Due to insufficient input sanitization of user-supplied data in the "Last Name", "First Name", and "Username" fields, attackers can inject malicious JavaScript payloads that persist in the database and execute when an authenticated user views the affected profile.

Critical Impact
Attackers can inject stored XSS payloads through CSV user imports, enabling session hijacking, credential theft, and malicious actions in the context of authenticated users viewing affected profiles.

Affected Products

Chamilo LMS versions prior to 1.11.30
Chamilo LMS CSV user import functionality (main/user/user_import.php)

Discovery Timeline

2026-03-02 - CVE-2025-52468 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52468

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) occurs within the CSV user import feature of Chamilo LMS. When administrators import user accounts via CSV files, the application fails to properly sanitize user-controlled input fields before storing them in the database. The vulnerable fields include "Last Name", "First Name", and "Username" - all of which are commonly displayed throughout the LMS interface.

The attack is particularly effective because user profile information is rendered in multiple contexts across the application, including course enrollments, discussion forums, grade books, and administrative user lists. Any authenticated user who views a profile containing malicious payload will execute the injected script in their browser context.

Root Cause

The root cause is insufficient input sanitization in the main/user/user_import.php file. The CSV import functionality processed user data without applying proper XSS removal filters before database insertion. The vulnerability allowed HTML and JavaScript content in name fields to be stored and subsequently rendered without proper output encoding.

Attack Vector

An attacker with access to the CSV user import feature (typically administrators or users with elevated privileges) can craft a malicious CSV file containing XSS payloads in user profile fields. When this CSV is imported:

The malicious payload is stored in the database without sanitization
When any user views the affected profile or user listing, the XSS payload executes
The attacker can steal session tokens, perform actions as the victim, or redirect users to malicious sites

The vulnerability requires user interaction (viewing the compromised profile) and can affect users across different trust boundaries, enabling cross-scope attacks against other administrators or instructors.

php

 
if ($form->validate()) {
    if (isset($_FILES['import_file']['size']) && $_FILES['import_file']['size'] !== 0) {
-        $unsubscribe_users = isset($_POST['unsubscribe_users']) ? true : false;
+        $unsubscribe_users = isset($_POST['unsubscribe_users']);
        //@todo : csvToArray deprecated
        $users = Import::csvToArray($_FILES['import_file']['tmp_name']);
        $invalid_users = [];

Source: GitHub Commit Details

The patch shown above is part of broader security improvements that apply XSS removal when importing users. The complete fix adds input sanitization to filter malicious script content from all user-controlled fields during CSV import processing.

Detection Methods for CVE-2025-52468

Indicators of Compromise

Unusual JavaScript or HTML content stored in user profile fields (Last Name, First Name, Username)
User accounts with encoded script tags such as <script>, javascript:, or event handlers like onerror=
Database entries in user tables containing suspicious payloads
Unexpected network requests originating from user browser sessions after viewing user profiles

Detection Strategies

Implement database queries to identify user records containing HTML tags or JavaScript patterns in name fields
Deploy Web Application Firewall (WAF) rules to detect XSS payloads in CSV upload requests
Enable audit logging for all CSV import operations and review imported data for anomalies
Monitor application logs for CSV imports followed by unusual session activity

Monitoring Recommendations

Configure Content Security Policy (CSP) headers to restrict inline script execution and report violations
Set up real-time alerts for any CSP violation reports originating from user profile pages
Monitor for suspicious outbound connections from user browsers that may indicate payload execution
Review administrative action logs for CSV user import activities from unexpected sources

How to Mitigate CVE-2025-52468

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.30 or later immediately
Audit existing user database records for any injected XSS payloads in name fields
Sanitize any discovered malicious content in user profile fields
Review CSV import access permissions and restrict to trusted administrators only

Patch Information

The vulnerability has been patched in Chamilo LMS version 1.11.30. The fix implements proper XSS removal filters during the CSV user import process, ensuring that malicious script content is sanitized before database storage. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to the GitHub Security Advisory GHSA-hc3c-8p55-xh4r and the GitHub Release v1.11.30.

Workarounds

Disable CSV user import functionality until the patch can be applied
Implement server-side input validation to strip HTML/JavaScript from all user import fields
Deploy a Web Application Firewall (WAF) with XSS detection rules for the import endpoint
Restrict access to the user import feature to only the most trusted administrators

bash

# Database query to identify potentially compromised user accounts
mysql -u admin -p chamilo_db -e "SELECT id, firstname, lastname, username FROM user WHERE firstname LIKE '%<script%' OR lastname LIKE '%<script%' OR username LIKE '%<script%' OR firstname LIKE '%javascript:%' OR lastname LIKE '%javascript:%';"