CVE-2026-39878: Chamilo stored XSS via user registration leads to admin account takeover

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-10-24
Weakness: CWE-79

Description

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

Affected products

chamilo-lms: through 1.11.38

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg
https://vokecyber.com/research/cve-2026-39878-chamilo-lms-stored-xss

Get alerted when CVE-2026-39878 or the next vulnerability affects your stack