CVE-2026-33705

Published: Apr 10, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

Affected (1)

Products: Chamilo: Chamilo Lms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Chamilo Chamilo Lms	Before 1.11.38

Related CWEs

Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

References (2)

https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff

Source: security-advisories@github.com

Patch

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.