Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in …

Critical CVSS 9.3

CVECVE-2026-39878

First seen2026-08-21 20:30 UTC

Disclosed2026-07-20 18:16 UTC

Last updated2026-08-21 20:30 UTC

Channel statusauto

Summary

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg
https://vokecyber.com/research/cve-2026-39878-chamilo-lms-stored-xss

Timeline

2026-08-21 nvd_ingest NVD