CVE-2025-59542
Published: 06 March 2026
Summary
CVE-2025-59542 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs to the course learning path Settings field to prevent injection of malicious JavaScript by low-privileged users.
Filters output from the vulnerable settings field to block execution of stored malicious scripts in the browsers of viewing users, including administrators.
Remediates the specific stored XSS flaw by identifying, reporting, and applying the patch released in Chamilo version 1.11.34.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS directly enables script injection/execution in victim browsers (T1059.007, T1185) via public web app exploitation (T1190), leading to cookie/token theft (T1539) and account takeover.
NVD Description
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary…
more
JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.
Deeper analysisAI
CVE-2025-59542 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in Chamilo, an open-source learning management system. It affects versions prior to 1.11.34 and occurs in the course learning path Settings field, where malicious JavaScript can be injected and persistently stored. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), reflecting its critical potential impact due to network accessibility, low complexity, and high confidentiality, integrity, and availability consequences.
An attacker with a low-privileged account, such as a trainer, can exploit this by injecting arbitrary JavaScript into the vulnerable field. The script then executes in the browser context of any user who views the affected course information page, including administrators. This allows exfiltration of sensitive data like session cookies or tokens, enabling account takeover of higher-privileged users.
The issue has been patched in Chamilo version 1.11.34. Organizations should upgrade to this version or later to mitigate the vulnerability. Additional details are available in the GitHub release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 and the security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pxrh-3rcp-h7m6.
Details
- CWE(s)