CVE-2026-112031

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.41 Chamilo LMS versions prior to 2.0.4 Chamilo LMS versions prior to 3.0.2

Description Remote cross site scripting is possible within the Ticket Module due to improper handling of the Name argument in the TicketManager::addProject() function located in the main/inc/lib/TicketManager.php file. Cross site scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Apply the official patches to resolve the issue for versions prior to 1.11.41. Apply the official patches to resolve the issue for versions prior to 2.0.4. Apply the official patches to resolve the issue for versions prior to 3.0.2.