Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw o…

A stored cross-site scripting (XSS) vulnerability exists in Chamilo learning management system prior to version 1.11.30. The flaw occurs during CSV file import of user data due to insufficient input validation and sanitization of the Last Name, First Name, and Username fields. Attackers can inject malicious XSS payloads that execute when user profiles are viewed by authenticated users. The vulnerability allows for malicious script execution in the context of authenticated users. This security issue has been addressed and patched in Chamilo version 1.11.30.