CVE-2025-50186 - CVE House
Back to Database
Status published Medium CVE-2025-50186

Chamilo: Stored XSS via Malicious CSV Filename in user_import.php

Vulnerability Description

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-50186

Credits & Attribution

No credits recorded in the NVD database.

References

More from chamilo

View All →
CVE-2025-66447
Chamilo LMS has validation-less redirect on login page
Unknown 0
CVE-2025-59544
Chamilo: Unauthorized access to update category of any user
Medium 6.9
CVE-2025-59543
Chamilo: Account Takeover via Stored XSS in Course Description
Critical 9.1
CVE-2025-59542
Chamilo: Account Takeover via Stored XSS in Course Learning Paths
Critical 9.1
CVE-2025-59541
Chamilo: CSRF Vulnerability in Project Deletion
High 8.1

Affected Vendor

Affected Software

chamilo-lms
Vulnerable Versions:
< 1.11.30

Timeline

Official Publish: March 2nd, 2026
Last Modified: March 2nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact