CVE-2026-33737

Published: Apr 10, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Affected (11)

Products: Chamilo: Chamilo Lms

Chamilo

1 product

Chamilo Lms

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Chamilo Chamilo Lms	Before 1.11.38
Chamilo Chamilo Lms	Version 2.0.0 alpha1
Chamilo Chamilo Lms	Version 2.0.0 alpha2
Chamilo Chamilo Lms	Version 2.0.0 alpha3
Chamilo Chamilo Lms	Version 2.0.0 alpha4
Chamilo Chamilo Lms	Version 2.0.0 alpha5
Chamilo Chamilo Lms	Version 2.0.0 beta1
Chamilo Chamilo Lms	Version 2.0.0 beta2
Chamilo Chamilo Lms	Version 2.0.0 beta3
Chamilo Chamilo Lms	Version 2.0.0 rc1
Chamilo Chamilo Lms	Version 2.0.0 rc2

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (3)

https://github.com/chamilo/chamilo-lms/commit/22b1cb1c609b643765c88654155aba27070c927e

Source: security-advisories@github.com

Patch

https://github.com/chamilo/chamilo-lms/commit/af6b7002af7c15825e98fc522e2ead0d00cacaa3

Source: security-advisories@github.com

Patch

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-c4ww-qgf2-v89j

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.