CVE-2025-52482: Chamilo LMS Stored XSS Vulnerability

CVE-2025-52482 Overview

CVE-2025-52482 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Chamilo, an open-source learning management system (LMS). The vulnerability exists in the glossary function of Chamilo versions prior to 1.11.30, allowing users with Teacher role privileges to inject malicious JavaScript code that executes in the context of administrator sessions.

This vulnerability represents a significant security risk in educational environments where Chamilo is deployed, as it enables privilege escalation attacks through persistent script injection. When an administrator views a compromised glossary entry, the malicious JavaScript executes with their elevated privileges, potentially leading to session hijacking, administrative account compromise, or further system exploitation.

Critical Impact
Teachers can inject persistent JavaScript payloads via the glossary function, enabling attacks against administrators that can result in session hijacking, credential theft, or full administrative account takeover.

Affected Products

Chamilo LMS versions prior to 1.11.30
All installations with the glossary function enabled
Systems where Teacher-level accounts have access to create or modify glossary entries

Discovery Timeline

2026-03-02 - CVE-2025-52482 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52482

Vulnerability Analysis

The Stored XSS vulnerability in Chamilo LMS occurs due to insufficient input sanitization within the glossary function. When users with Teacher privileges create or edit glossary entries, the application fails to properly validate and sanitize user-supplied input before storing it in the database and subsequently rendering it in the browser.

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents one of the most common web application security flaws. The stored nature of this XSS makes it particularly dangerous because the malicious payload persists in the database and executes every time the compromised content is viewed.

The attack requires authentication with Teacher-level privileges, which limits the initial attack surface but still represents a significant threat in multi-tenant educational environments where Teacher accounts are widely distributed.

Root Cause

The root cause of this vulnerability lies in inadequate input validation and output encoding within the glossary module. Specifically:

Input Validation Failure: The glossary function accepts HTML and JavaScript content from Teacher users without proper sanitization
Output Encoding Deficiency: When glossary content is rendered in administrator views, the application fails to properly encode potentially dangerous characters
Trust Model Flaw: The application incorrectly assumes Teacher-level users will only submit benign content

The fix, implemented across multiple commits, addresses these issues by implementing proper input sanitization and output encoding for glossary content.

Attack Vector

The attack leverages the network-accessible glossary function and requires the attacker to have Teacher-level credentials. The exploitation flow works as follows:

An attacker with Teacher privileges accesses the glossary management interface
The attacker creates or modifies a glossary entry, injecting JavaScript code into a vulnerable field
The malicious payload is stored in the Chamilo database without proper sanitization
When an administrator views the glossary section or a page containing the glossary term, the injected JavaScript executes in their browser context
The malicious script can steal session cookies, perform actions as the administrator, or redirect to phishing pages

The vulnerability requires user interaction (the administrator must view the compromised content), but given that administrators regularly review educational content, this condition is likely to be met in normal operations.

Due to the sensitive nature of this vulnerability, specific exploitation code is not provided. The vulnerability mechanism involves injecting JavaScript payloads into glossary entry fields that are not properly sanitized. For technical implementation details, refer to the GitHub Security Advisory GHSA-4wcp-3rh3-7wm4.

Detection Methods for CVE-2025-52482

Indicators of Compromise

Glossary entries containing <script> tags, event handlers (onerror, onload, onclick), or JavaScript URIs
Database records in glossary tables with HTML encoding anomalies or suspicious JavaScript patterns
Administrator session cookies appearing in unexpected network requests to external domains
Unusual administrative actions occurring without corresponding administrator logins

Detection Strategies

Implement web application firewall (WAF) rules to detect XSS patterns in glossary-related HTTP POST requests
Deploy database monitoring to alert on glossary entries containing script tags or JavaScript event handlers
Enable Content Security Policy (CSP) headers to detect and block inline script execution attempts
Review Chamilo access logs for Teacher accounts making unusual numbers of glossary modifications

Monitoring Recommendations

Monitor administrator sessions for signs of hijacking such as concurrent sessions from different IP addresses
Implement browser-based XSS auditing and ensure administrator browsers have modern XSS protection enabled
Set up alerts for glossary content modifications and implement content review workflows
Deploy endpoint detection solutions capable of identifying malicious JavaScript execution patterns

How to Mitigate CVE-2025-52482

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.30 or later immediately
Audit existing glossary entries for any signs of injected malicious content
Review administrator session logs for any suspicious activity that may indicate prior exploitation
Consider temporarily restricting Teacher access to the glossary function until patching is complete

Patch Information

Chamilo has released version 1.11.30 which addresses this vulnerability. The fix was implemented across multiple commits:

The official release is available at the GitHub Release v1.11.30 page. For complete vulnerability details, see the GitHub Security Advisory GHSA-4wcp-3rh3-7wm4.

Workarounds

Implement Content Security Policy headers to restrict inline script execution as a defense-in-depth measure
Temporarily disable or restrict access to the glossary function for Teacher accounts until patching is completed
Deploy a web application firewall with XSS detection rules in front of the Chamilo installation
Implement input validation at the web server or reverse proxy level to filter known XSS patterns

bash

# Example Content Security Policy header configuration for Apache
# Add to your Chamilo Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"

# For nginx, add to your server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';";