CVE-2026-33705

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33705
Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff Patch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*
History

16 Apr 2026, 18:29

Type Values Removed Values Added
First Time Chamilo chamilo Lms
Chamilo
CPE cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*
References () https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff - () https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff - Patch
References () https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57 - () https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57 - Vendor Advisory

10 Apr 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-10 19:16

Updated : 2026-04-16 18:29

NVD link : CVE-2026-33705

Mitre link : CVE-2026-33705

CVE.ORG link : CVE-2026-33705

JSON object : View

Products Affected

chamilo

  • chamilo_lms
CWE
CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory