CVE-2025-52470: Chamilo LMS Stored XSS Vulnerability

CVE-2025-52470 Overview

CVE-2025-52470 is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS, an open-source learning management system. The flaw resides in the session_category_add.php script, where the Category Name field is not properly sanitized before storage. Privileged users can inject persistent JavaScript payloads that execute when administrators access add_many_sessions_to_category.php. The issue affects all Chamilo versions prior to 1.11.30 and is tracked under [CWE-79]. Exploitation requires high privileges and user interaction, but successful attacks can compromise administrative sessions through scope-changing payloads.

Critical Impact
Attackers with privileged accounts can store malicious JavaScript that executes in administrator browsers, enabling session compromise and unauthorized actions within the Chamilo administrative interface.

Affected Products

Chamilo LMS versions prior to 1.11.30
Deployments exposing session_category_add.php to privileged but non-trusted users
Multi-administrator instances where category management is delegated

Discovery Timeline

2026-03-02 - CVE-2025-52470 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52470

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in Chamilo LMS session category management. When a privileged user creates a session category through session_category_add.php, the application stores the Category Name value without applying output encoding or HTML sanitization. The stored payload is later rendered when an administrator visits add_many_sessions_to_category.php, causing arbitrary JavaScript to execute in the victim's browser context.

Because the payload persists in the database, every administrator who navigates to the affected page becomes a target. The scope-changing characteristic of the flaw means injected scripts can interact with other parts of the application beyond the originally vulnerable component, extending impact to session data and authenticated actions.

Root Cause

The root cause is improper neutralization of user-supplied input in the Category Name field. Chamilo's session category creation flow lacked HTML purification on the input field and did not apply contextual output encoding when rendering category names. The upstream fix introduces use of RemoveOnAttributes from the HTMLPurifier filter component to strip dangerous event handler attributes from stored values.

Attack Vector

An authenticated attacker with privileges to create session categories submits a crafted Category Name containing a JavaScript payload, such as an HTML element with an inline event handler. The payload is persisted in the categories table. When any administrator opens add_many_sessions_to_category.php, the unsanitized value is reflected into the page and executed by the browser, granting the attacker control over the administrator's session context.

php

/* For licensing terms, see /license.txt */

use Chamilo\CoreBundle\Component\HTMLPurifier\Filter\RemoveOnAttributes;
use Chamilo\CoreBundle\Entity\Course;
use Chamilo\CoreBundle\Entity\ExtraField;
use Chamilo\CoreBundle\Entity\Repository\SequenceResourceRepository;

Source: Chamilo LMS commit ead79db — the patch adds the RemoveOnAttributes HTMLPurifier filter to main/inc/lib/sessionmanager.lib.php to strip on* event handler attributes from category names.

Detection Methods for CVE-2025-52470

Indicators of Compromise

Session category records containing HTML tags, <script> blocks, or on* event handler attributes in the name column
Unexpected outbound HTTP requests originating from administrator browsers shortly after viewing add_many_sessions_to_category.php
Administrative actions performed from unusual IP addresses or at unusual times following category page visits

Detection Strategies

Query the Chamilo database for session category names matching patterns such as <, javascript:, or on\w+= to identify stored payloads
Review web server access logs for POST requests to session_category_add.php containing encoded HTML or script characters in the name parameter
Inspect authenticated session activity for anomalous API calls or privilege changes triggered from administrative accounts

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in the administrative interface
Forward Chamilo web and application logs to a centralized logging platform and alert on suspicious input patterns
Audit privileged user accounts that can create session categories and review their recent submissions

How to Mitigate CVE-2025-52470

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.30 or later, which contains the official fix
Audit existing session category records and remove or sanitize any entries containing HTML or scripting content
Rotate administrative session cookies and credentials if stored payloads are discovered

Patch Information

The vulnerability is resolved in Chamilo LMS 1.11.30. The fix is implemented in commit ead79db4eb034b8c11a3d6036759d083de37530c, which integrates the RemoveOnAttributes HTMLPurifier filter into sessionmanager.lib.php to strip event handler attributes from category names. See the GitHub Security Advisory GHSA-p4m6-gwhg-x89f and the Chamilo v1.11.30 release notes for full details.

Workarounds

Restrict the privilege to create session categories to a minimum set of trusted administrators until patching is complete
Deploy a web application firewall rule that blocks HTML tags and event handler attributes in the Category Name parameter
Apply a strict Content Security Policy that disallows inline JavaScript on Chamilo administrative pages

bash

# Upgrade Chamilo LMS to the patched release
cd /var/www/chamilo
git fetch --tags
git checkout v1.11.30
php bin/console cache:clear --env=prod