CVE-2025-66447

EUVD-2025-209408
Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
0 NONE
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Affected Products (NVD)
VendorProductVersion
chamilochamilo_lms
𝑥
≤ 1.11.38
chamilochamilo_lms
2.0.0:alpha1
chamilochamilo_lms
2.0.0:alpha2
chamilochamilo_lms
2.0.0:alpha3
chamilochamilo_lms
2.0.0:alpha4
chamilochamilo_lms
2.0.0:alpha5
chamilochamilo_lms
2.0.0:beta1
chamilochamilo_lms
2.0.0:beta2
chamilochamilo_lms
2.0.0:beta3
chamilochamilo_lms
2.0.0:rc1
chamilochamilo_lms
2.0.0:rc2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/chamilo/chamilo-lms/commit/73ae6293adaa6098374bc22625342dbae5cbc446
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m82x-prv3-rwwv