CVE-2025-55208 - Vulnerability Analysis

Overview

Chamilo < 1.11.34 contains a stored XSS caused by insecure file uploads in Social Networks, letting low-privilege users execute arbitrary code in admin inbox, exploit requires low-privilege user access.

Severity & Score

Impact

Low-privilege users can execute arbitrary code in admin inbox, potentially leading to full admin account takeover.

Mitigation

Update to version 1.11.34 or later.

References

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-2vq2-826h-6hp6

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🔴 CVE-2025-55208 - Critical (9) Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55208/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner