CVE-2026-33705

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff	Patch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Chamilo LMS es un sistema de gestión de aprendizaje. Antes de la versión 1.11.38, los archivos de plantilla Twig (.tpl) bajo /main/template/default/ son directamente accesibles sin autenticación a través de solicitudes HTTP GET. Estas plantillas exponen lógica interna de la aplicación, nombres de variables, URLs de puntos finales AJAX y la estructura del panel de administración. Esta vulnerabilidad está corregida en la versión 1.11.38.

Information

Published : 2026-04-10 19:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33705

Mitre link : CVE-2026-33705

CVE.ORG link : CVE-2026-33705

JSON object : View

Products Affected

chamilo

chamilo_lms

CWE

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

{"id": "CVE-2026-33705", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33705", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T15:02:23.156125Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "< 1.11.38"}]}]}], "published": "2026-04-10T19:16:23.653", "references": [{"url": "https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-538"}]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38."}, {"lang": "es", "value": "Chamilo LMS es un sistema de gesti\u00f3n de aprendizaje. Antes de la versi\u00f3n 1.11.38, los archivos de plantilla Twig (.tpl) bajo /main/template/default/ son directamente accesibles sin autenticaci\u00f3n a trav\u00e9s de solicitudes HTTP GET. Estas plantillas exponen l\u00f3gica interna de la aplicaci\u00f3n, nombres de variables, URLs de puntos finales AJAX y la estructura del panel de administraci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.11.38."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4D0C5D2-6FA0-4532-8E3D-4EA111A50621", "versionEndExcluding": "1.11.38"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}