{"id":"CVE-2026-45143","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-45143","summary":"Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders…","details":"Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. An authenticated low-privilege user, including a student, can directly address crafted message content to an administrator because the message creation flow permits a sender to select another user as the recipient. The content executes in the recipient's browser when the recipient opens the routine inbox or message view, without requiring a link click, and can expose session credentials or permit actions as the administrator. This vulnerability is fixed in 2.0.1.","published":"2026-09-17T21:17:12.600","modified":"2026-09-17T21:17:12.600","cvss":{"score":9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/chamilo/chamilo-lms/commit/b2c91c021fc5ab7e91feb4927c4c676f77034ac5","label":"chamilo/chamilo-lms@b2c91c0"},"references":[{"type":"WEB","url":"https://github.com/chamilo/chamilo-lms/commit/b2c91c021fc5ab7e91feb4927c4c676f77034ac5"},{"type":"WEB","url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"},{"type":"WEB","url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x88v-rg6r-vqq6"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T21:17:12.600"}}