CVE-2026-39878: Chamilo LMS Stored XSS Vulnerability

CVE-2026-39878 Overview

CVE-2026-39878 is a stored cross-site scripting (XSS) vulnerability in Chamilo LMS versions 1.11.38 and earlier. The flaw resides in the user registration form and allows unauthenticated attackers to inject arbitrary JavaScript. When an administrator later views the affected content, the payload executes in their browser session. Successful exploitation results in full administrator account takeover of the learning platform. The issue is tracked under [CWE-79] and has been patched in Chamilo LMS version 1.11.40.

Critical Impact
Unauthenticated attackers can execute JavaScript in an administrator's session, leading to complete platform admin account takeover.

Affected Products

Chamilo LMS versions 1.11.38 and earlier
Chamilo LMS user registration form component
All deployments prior to fixed release 1.11.40

Discovery Timeline

2026-07-20 - CVE-2026-39878 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-39878

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Chamilo LMS user registration workflow. Chamilo LMS is a widely deployed open-source learning management system used by universities and enterprises. Attackers submit registration data containing JavaScript payloads through the public registration form. The server persists these values without sufficient output encoding or input sanitization. When an administrator reviews user records, pending registrations, or related interfaces, the stored payload renders and executes in the administrator's authenticated browser context.

Because the attack requires no authentication and the payload executes with administrator privileges, an attacker can perform any action available to the admin. This includes creating rogue administrator accounts, extracting user data, modifying course content, or pivoting to deeper compromise of the hosting infrastructure.

Root Cause

The root cause is missing or insufficient sanitization of user-supplied fields in the registration form. User input is stored in the database and later rendered in administrative views without proper HTML entity encoding. This maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker submits a crafted registration request containing JavaScript in vulnerable fields. Exploitation completes when an administrator opens the affected view, satisfying the user interaction requirement. The scope is changed because code executes in the administrator's authenticated session rather than the attacker's context. See the Chamilo GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-39878

Indicators of Compromise

Registration records containing <script>, onerror=, onload=, or javascript: sequences in name, username, or profile fields
Unexpected administrator account creation events following pending-user reviews
Outbound requests from administrator browsers to unfamiliar external hosts shortly after accessing the user management console
Session token reuse from IP addresses that differ from the administrator's typical geolocation

Detection Strategies

Review web server access logs for POST requests to registration endpoints containing HTML-encoded or raw script tags
Query the users table for rows where text columns contain angle brackets, event handler attributes, or URL scheme prefixes
Alert on new administrator role assignments that occur outside change-management windows
Correlate administrator login sessions with sudden privilege modifications to other accounts

Monitoring Recommendations

Enable web application firewall rules that inspect registration form submissions for XSS payload patterns
Monitor Chamilo LMS audit logs for role escalations and configuration changes
Track browser-side Content Security Policy violation reports for administrator sessions
Baseline administrator session activity and flag deviations in API call patterns

How to Mitigate CVE-2026-39878

Immediate Actions Required

Upgrade all Chamilo LMS instances to version 1.11.40 or later without delay
Audit existing user records for injected script content and purge malicious entries
Reset credentials and session tokens for all administrator accounts as a precaution
Review recent administrator activity logs for unauthorized changes since the vulnerable version was deployed

Patch Information

Chamilo has released version 1.11.40 which contains the fix for CVE-2026-39878. The patch details are documented in the Chamilo GitHub Security Advisory GHSA-gcjp-f7jm-rrrg. Administrators should apply the upgrade following the standard Chamilo update procedure and verify database migrations complete successfully.

Workarounds

Disable public user self-registration until the patch is applied by restricting registration to administrator-created accounts
Deploy a web application firewall rule to block registration submissions containing script tags or common XSS payload patterns
Enforce a strict Content Security Policy that disallows inline script execution in administrator interfaces
Require administrators to review pending users in a hardened, isolated browser profile until upgrade is complete

bash

# Configuration example: restrict registration and enforce CSP at the reverse proxy
# Nginx snippet to block obvious XSS payloads on the registration endpoint
location /main/auth/inscription.php {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|javascript:|onerror=|onload=)") {
            return 403;
        }
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    proxy_pass http://chamilo_backend;
}