CVE-2026-45143

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 2.0.0 through 2.1.0

Description Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view message.html.twig. An authenticated low-privilege user, such as a student, can send crafted message content to an administrator. The content executes in the recipient's browser upon opening the inbox or message view, which can expose session credentials or allow actions to be performed as the administrator.

Recommendations Update Chamilo LMS to version 2.0.1.