CVE-2026-33737 Chamilo LMS has an XML External Entity (XXE) Injection

Medium 5.3 Published 10 Apr 2026 Updated 13 Apr 2026

An attacker can read arbitrary server files via XML External Entity injection in Chamilo LMS due to unsafe XML parsing.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33737?

CVE-2026-33737 is a medium-severity vulnerability in Chamilo Chamilo Lms, published on 10 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Weakness: CWE-611

Which versions are affected by CVE-2026-33737?

It affects 1 product.

Products include Chamilo Chamilo Lms.

How do I fix CVE-2026-33737?

No fix has been published for CVE-2026-33737 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33737 being exploited?

There is no known exploitation of CVE-2026-33737 in the wild and no public exploit code.

All Chamilo Chamilo Lms vulnerabilities

Sources

Also known as GHSA-c4ww-qgf2-v89j.