CVE case study
CVE-2026-70649: Stored XSS in Chamilo LMS Social-Group Discussions via Unsanitized v-html
Chamilo LMS 2.0.0 through 2.0.2 rendered social-group discussion messages with Vue's v-html and no sanitization, so a low-privileged group member could store JavaScript that ran when another member, teacher, or administrator opened the thread. Version 2.0.3 sanitizes the content on write and on render.
- Weakness
- CWE-79
- Affected
- Chamilo LMS 2.0.0 through 2.0.2
- Remediation state
- Upgrade to Chamilo LMS 2.0.3 or later
- Advisory published
- 31 Aug 2026
Official vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Why it matters
Chamilo LMS renders social-group discussion messages in a Vue component (MessageItem.vue) with v-html and no sanitizer. In versions 2.0.0 through 2.0.2, the /social/group-action endpoint read the message content straight from the request body, required only group membership to post, and persisted it verbatim through MessageManager::send_message().
Because the stored content is rendered as raw HTML, a low-privileged group member could plant JavaScript that executed in the browser of any member, moderator, teacher, or administrator who later opened the discussion thread. No extra click or phishing link is needed beyond viewing the thread, and groups used for course-wide or moderation workflows put privileged users in front of that content routinely.
The public record scores the issue Critical at 9.0 with changed scope, because the payload runs in the victim's authenticated Chamilo origin and can lead to session or token theft, privileged actions, or account takeover when an administrator is the viewer. It was reported as a distinct social-group sink separate from the earlier private-message CVE-2026-45143, and version 2.0.3 sanitizes the content both on write and on render.