CVE-2026-33705
Chamilo LMS has unauthenticated access to Twig template source files exposes application logic
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 10, 2026
- Updated
- Apr 15, 2026
- Reserved
- Mar 23, 2026
Description
Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
Weaknesses
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected Products
| Product | Versions |
|---|---|
chamilo-lmschamilo |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.