CVE-2025-50186 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains a stored XSS caused by insufficient sanitization of CSV filenames, letting attackers execute JavaScript when malicious CSV files are viewed by admins or users with import log access, exploit requires file upload capability.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in the context of administrators or privileged users, potentially leading to session hijacking or further attacks.

Mitigation

Update to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wrx6-5v5r-mmgx
• https://github.com/chamilo/chamilo-lms/commit/9fef8f30b41d586cb4f4fc823906c16a12ae0ff4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner