CVE-2026-32893: Chamilo LMS XSS Vulnerability

CVE-2026-32893 Overview

CVE-2026-32893 is a Reflected Cross-Site Scripting (XSS) vulnerability in Chamilo LMS, an open-source learning management system. The vulnerability exists in the exercise question list admin panel, where the pagination code improperly handles URL parameters by merging all $_GET parameters via array_merge() and outputs the result through http_build_query() directly into HTML href attributes without proper htmlspecialchars() encoding.

This flaw allows an attacker to craft malicious URLs that, when clicked by an authenticated teacher, execute arbitrary JavaScript in their browser context. The vulnerability impacts versions prior to 2.0.0-RC.3.

Critical Impact

Attackers can execute arbitrary JavaScript in the browser of authenticated teachers, potentially leading to session hijacking, credential theft, or unauthorized actions within the Chamilo LMS platform.

Affected Products

• Chamilo LMS versions prior to 2.0.0-RC.3

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-32893 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-32893

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw occurs in the pagination functionality of the exercise question list admin panel. When generating pagination links, the code blindly merges all incoming $_GET parameters and uses them to construct URLs without proper output encoding.

The absence of htmlspecialchars() encoding when outputting the URL into HTML href attributes allows attackers to inject malicious payloads. When a teacher with an authenticated session clicks a maliciously crafted link, the attacker's JavaScript executes within the context of the victim's browser session, potentially compromising their session tokens, performing actions on their behalf, or exfiltrating sensitive data.

Root Cause

The root cause is improper output encoding in the pagination code within public/main/exercise/question_list_admin.inc.php. The vulnerable code uses array_merge($_GET, ['page' => $i]) to construct pagination URLs and directly outputs the result via http_build_query() into HTML attributes. This approach fails to sanitize or encode user-controlled input, creating a reflected XSS attack surface.

Attack Vector

The attack vector requires an authenticated teacher to click a maliciously crafted URL. An attacker can embed arbitrary JavaScript in URL parameters, which will be reflected back into the page's HTML without sanitization. The attacker typically delivers this malicious link through phishing emails, social engineering, or by placing the link on a website the target is likely to visit.

// Vulnerable code (before patch)
echo '<a href="?' . http_build_query(array_merge($_GET, ['page' => $i])) . '" class="mx-1 px-4 py-2 border ' . $isActive . ' rounded">' . $i . '</a>';

// Fixed code (after patch) - implements allowlist filtering
$allowedParams = [
    'cid' => 0,
    'sid' => 0,
    'gid' => 0,
    'gradebook' => 0,
    'origin' => '',
    'exerciseId' => 0,
    'page' => 0,
];
$filteredGet = array_intersect_key($_GET, $allowedParams);
echo Display::url(
    $i,
    '?'.http_build_query(array_merge($filteredGet, ['page' => $i])),
    ['class' => $i == $page ? 'btn btn--primary' : 'btn btn--plain']
);

Source: GitHub Commit Update

Detection Methods for CVE-2026-32893

Indicators of Compromise

• Unusual URL patterns containing JavaScript payloads in GET parameters targeting /main/exercise/question_list_admin.inc.php
• Web server logs showing requests with encoded script tags or event handlers in query string parameters
• Reports from authenticated teachers of unexpected behavior or pop-ups when accessing exercise management pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing XSS payloads in URL parameters
• Monitor HTTP access logs for suspicious patterns including <script>, javascript:, onerror=, and similar XSS indicators in query strings
• Deploy browser-based Content Security Policy (CSP) headers to limit the impact of successful XSS exploitation

Monitoring Recommendations

• Enable detailed logging for the Chamilo LMS admin panel, particularly for exercise management endpoints
• Configure SIEM alerts for anomalous patterns in web application logs targeting pagination parameters
• Regularly review access logs for requests with unusually long or encoded query strings

How to Mitigate CVE-2026-32893

Immediate Actions Required

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later immediately
• Review web server logs for evidence of exploitation attempts
• Notify teachers and administrators to be cautious of unexpected links to the Chamilo admin panel
• Implement Content Security Policy headers to reduce the impact of potential XSS attacks

Patch Information

The vulnerability is fixed in Chamilo LMS version 2.0.0-RC.3. The patch implements an allowlist approach for URL parameters, using array_intersect_key() to filter $_GET parameters against a predefined list of allowed parameters before constructing pagination URLs. This effectively prevents arbitrary user input from being reflected into the page.

For detailed patch information, refer to the GitHub Commit and the GitHub Security Advisory GHSA-37jh-g64j-88mc.

Workarounds

• Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS attacks
• Deploy a Web Application Firewall (WAF) with XSS detection rules in front of the Chamilo LMS instance
• Restrict access to the admin panel to trusted IP addresses only until the patch can be applied

# Example Apache configuration to add basic CSP headers
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
</IfModule>