CVE-2025-55289 is a stored cross-site scripting flaw in Chamilo LMS, scored CVSS 8.8 (high) and fixed in version 1.11.34. A user's input in the skills feature was not cleaned, so script could run in other users' browsers, including administrators. Upgrade to 1.11.34 or later.
What's affected
The NVD record says Chamilo versions prior to 1.11.34 are affected, and the GitHub advisory names 1.11.32 as the version tested and lists affected versions as 1.11.32 and below. The patched version is 1.11.34. The package is chamilo/chamilo-lms on Composer.
The advisory traces the flaw to the argumentation parameter used when a skill is given to a user. Script placed there can reach the social network and internal messaging features. The advisory is dated 5 March 2026.
How to check if you're exposed
Find your Chamilo version and compare it with 1.11.34. The version appears in your installation's administration area and in the release files you deployed. If you installed with Composer, composer show chamilo/chamilo-lms prints the installed version, though many sites install from the release archive instead.
If you are below 1.11.34, you are in the affected range. If you cannot tell, treat the site as affected until you have confirmed.
Also look at your own data. Stored XSS leaves content in the database, so after upgrading, check skill assessments and messages created by lower trust users for markup that does not belong, and clean it.
What to do now
- Back up the site and database.
- Upgrade Chamilo to 1.11.34 or later, following the project's upgrade notes for your branch.
- Review stored skill comments, messages and social network posts for unexpected script or markup, and remove it.
- Restrict who can grant skills and write messages to trusted roles until the upgrade is done.
- Add a Content Security Policy header at your web server. It does not replace the fix, but it limits what injected script can do.
- Sign administrators out and ask them to sign in again after the upgrade, so any session exposed before is retired.
Why it matters
The class is CWE-79, failure to neutralize input during page generation. In stored XSS, the bad input is saved by the server and shown later to other people, which is why the advisory stresses administrators: their browser runs the script with their rights.
The listed impacts are session hijacking, actions taken as the victim, data theft and spreading to other users. A learning platform holds personal data and often has many low privilege users, so one unchecked field can reach the highest privilege account. Output encoding on every field, not just the obvious ones, is the lasting fix.
Quick check
Does Chamilo 1.11.33 contain the fix?
The advisory lists 1.11.34 as the patched version, so use that or later. I did not find a statement about 1.11.33.
Sources
Last reviewed: 19 October 2026.
