Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-33737

Chamilo LMS has an XML External Entity (XXE) Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

chamilo chamilo-lms

  • < 1.11.38affected
  • >= 2.0.0-alpha.1, < 2.0.0-RC.3affected

References