CVE-2026-82535: Chamilo LMS Stored XSS Vulnerability

CVE-2026-82535 Overview

CVE-2026-82535 is a stored cross-site scripting vulnerability [CWE-79] affecting Chamilo LMS versions prior to 1.11.42 and 3.0.0. The flaw resides in the survey submission endpoint, where authorization checks can be bypassed by computing deterministic invitation codes. Unauthenticated attackers can inject malicious HTML and JavaScript payloads into survey answers, which are rendered without escaping in reporting views. When a teacher or administrator opens the affected reports, the payload executes in their authenticated browser session. Attackers can leverage this to create persistent backdoor accounts by hijacking privileged sessions.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the sessions of teachers or administrators, enabling account takeover and persistent backdoor creation on affected Chamilo LMS instances.

Affected Products

Chamilo LMS versions prior to 1.11.42
Chamilo LMS versions prior to 3.0.0
Deployments exposing the survey reporting endpoint (main/survey/reporting.php)

Discovery Timeline

2026-09-11 - CVE-2026-82535 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-82535

Vulnerability Analysis

The vulnerability affects the Chamilo LMS survey subsystem, which accepts anonymous invitation-based submissions. The survey submission flow verifies participants using an invitationcode parameter, but the code generation algorithm produces deterministic values that unauthenticated attackers can predict or reproduce.

Once authorization is bypassed, an attacker can submit crafted answers containing raw HTML and JavaScript. The stored payload is later rendered inside survey reporting views without output escaping. Teachers and administrators viewing the results trigger execution of the injected script in their authenticated context.

Because the attacker controls script execution inside a privileged session, follow-on actions can include creating new administrative users, modifying course content, or exfiltrating session tokens for persistence.

Root Cause

Two issues combine to produce the vulnerability. First, the survey submission endpoint accepts a user_id shortcut path that skips proper invitation ownership validation. Second, survey answers are stored as raw input and echoed into reporting HTML without contextual output encoding, violating the safe rendering contract required by [CWE-79].

Attack Vector

The attack is delivered over the network and requires no prior authentication. The attacker computes a valid invitationcode, submits a survey answer containing a JavaScript payload, and waits for a teacher or administrator to open the reporting view. User interaction from the victim is required for payload execution.

php

// Patch: main/survey/fillsurvey.php - enforce required parameters
// and remove the user_id shortcut that bypassed invitation checks

// First we check if the needed parameters are present
-if ((!isset($_GET['course']) || !isset($_GET['invitationcode'])) && !isset($_GET['user_id'])) {
+if (!isset($_GET['course']) || !isset($_GET['invitationcode'])) {
     api_not_allowed(true, get_lang('SurveyParametersMissingUseCopyPaste'));
 }

Source: Chamilo commit c9d2614d

The patch removes the !isset($_GET['user_id']) fallback that allowed submissions to bypass the invitation code requirement. A companion change in main/survey/survey.download.inc.php restricts document serving to files actually referenced by the survey:

php

// Patch: main/survey/survey.download.inc.php - integer cast and
// restrict document serving to survey-referenced files
-    $doc_url = Database::escape_string($doc_url);
-    $survey_invitation['survey_id'] = Database::escape_string($survey_invitation['survey_id']);
+    $surveyId = (int) $survey_invitation['survey_id'];

Source: Chamilo commit bea9cbcf

Detection Methods for CVE-2026-82535

Indicators of Compromise

Anonymous POST requests to main/survey/fillsurvey.php or main/survey/meeting.php containing invitationcode values from unknown sources.
Survey answer records in the database containing <script>, onerror=, onload=, or javascript: substrings.
Unexpected creation of administrator or teacher accounts shortly after a report view session.
Access to main/survey/reporting.php immediately followed by privileged account modifications.

Detection Strategies

Inspect web server logs for high-volume enumeration of invitationcode parameter values from a single IP address.
Run database queries against the c_survey_answer table looking for HTML tags or JavaScript event handlers in stored responses.
Alert on new user accounts created from sessions that recently accessed survey reporting pages.

Monitoring Recommendations

Enable audit logging for administrative user creation and role changes in Chamilo.
Monitor Content Security Policy (CSP) violation reports for inline script execution on survey reporting pages.
Track outbound requests from administrator browsers to unknown domains during Chamilo sessions, which may indicate token exfiltration.

How to Mitigate CVE-2026-82535

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.42 or 3.0.0 without delay.
Audit the user table for accounts created after the patch window and revoke unauthorized administrator or teacher roles.
Review stored survey answers for HTML or script content and purge malicious entries before administrators view reports.
Rotate session secrets and force re-authentication for all privileged users.

Patch Information

The vendor released fixes across three commits: be45f2f2, bea9cbcf, and c9d2614d. These changes are consolidated in the Chamilo LMS v3.0.0 release and the 1.11.42 maintenance release. See the GitHub Security Advisory GHSA-m3wr-p8wj-jmf6 and the VulnCheck advisory for coordinated details.

Workarounds

Restrict access to main/survey/fillsurvey.php, main/survey/meeting.php, and main/survey/reporting.php at the web server or reverse proxy level until patching is complete.
Disable the survey module for anonymous participants if surveys are not actively in use.
Deploy a strict Content Security Policy that blocks inline scripts on Chamilo administrative pages.

bash

# Example nginx restriction limiting survey endpoints to trusted networks
location ~ ^/main/survey/(fillsurvey|meeting|reporting)\.php$ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}