Chamilo LMS before version 2.0.0-RC.3 is affected by a stored XSS vulnerability (CWE-79) in the social post attachment upload functionality. An authenticated attacker can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The application serves the uploaded file at a generated contentUrl without sanitizing the content, enforcing content type restrictions, or using a Content-Disposition: attachment header. This allows the embedded JavaScript to execute in the browser within the application's origin, enabling attacks such as session hijacking, account takeover, privilege escalation, and arbitrary actions on behalf of victims. The issue is resolved in version 2.0.0-RC.3.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the vulnerable Chamilo LMS application. This can lead to session hijacking, account takeover, privilege escalation (notably if an administrator views the malicious content), and unauthorized actions performed on behalf of other users. The vulnerability affects versions prior to 2.0.0-RC.3. No known exploits in the wild have been reported as of the published date.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where this vulnerability has been fixed. Since no official patch or temporary fix details are provided beyond the version update, applying this version upgrade is the recommended remediation. There is no indication that the vulnerability is mitigated by configuration changes or other workarounds.