Read the docs
TI-2026-76214 Aliases CVE-2026-112031GHSA-pr76-c2mp-rqp4

Cross-site scripting in Chamilo LMS Ticket Module

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

Chamilo LMS up to 1.11.40, 2.0.3 and 3.0.1 has a cross-site scripting flaw in its Ticket Module. The TicketManager::addProject function in main/inc/lib/TicketManager.php does not neutralize the Name argument, so injected script can run in a user's browser (CWE-79). A remote attacker with low privileges can exploit it with user interaction. A public exploit has been disclosed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamiloLMS1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; 1.11.6; 1.11.7; 1.11.8; 1.11.9; 1.11.10; 1.11.11; 1.11.12; 1.11.13; 1.11.14; 1.11.15; 1.11.16; 1.11.17; 1.11.18; 1.11.19; 1.11.20; 1.11.21; 1.11.22; 1.11.23; 1.11.24; 1.11.25; 1.11.26; 1.11.27; 1.11.28; 1.11.29; 1.11.30; 1.11.31; 1.11.32; 1.11.33; 1.11.34; 1.11.35; 1.11.36; 1.11.37; 1.11.38; 1.11.39; 1.11.40; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 3.0.0; 3.0.1—No fix listedCNA
  • LMS Vendorchamilo Affected 1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; 1.11.6; 1.11.7; 1.11.8; 1.11.9; 1.11.10; 1.11.11; 1.11.12; 1.11.13; 1.11.14; 1.11.15; 1.11.16; 1.11.17; 1.11.18; 1.11.19; 1.11.20; 1.11.21; 1.11.22; 1.11.23; 1.11.24; 1.11.25; 1.11.26; 1.11.27; 1.11.28; 1.11.29; 1.11.30; 1.11.31; 1.11.32; 1.11.33; 1.11.34; 1.11.35; 1.11.36; 1.11.37; 1.11.38; 1.11.39; 1.11.40; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 3.0.0; 3.0.1 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:lms:*:*:*:*:*:*:*:*——chamilo
  • cpe:2.3:a:chamilo:lms:*:*:*:*:*:*:*:* Versions — — ·chamilo

Remediation

The sources list no fixed version for Chamilo LMS. The source description points to patch commits 6dfa0f4de45afc1b27333304b4cd4532db478f74, dd3e4d32971efca4197eb2df97f69de25a786e3c, 119773d45c31da53b44cbfdb3f4910bc983cc7b0 and cb6fe2127e587603451c609b4ed78c0293fcc3fa.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112031
  2. 2026-10-19 Alias added: GHSA-pr76-c2mp-rqp4
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: LOW → MEDIUM

References

Patch 2

Other 1

  • TI-2023-17452 A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to… CVSS 3.1CRITICAL 9.8
  • TI-2023-03150 Chamilo LMS Unauthenticated Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
See all 162 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences