CVE-2026-33737 in LMS
Summary
by MITRE • 04/10/2026
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The Chamilo LMS vulnerability CVE-2026-33737 represents a critical server-side request forgery issue affecting versions prior to 1.11.38 and 2.0.0-RC.3. This vulnerability stems from the improper handling of XML data processing within multiple files of the learning management system. The core technical flaw involves the use of simplexml_load_string() function without adequate protection against XML External Entity (XXE) attacks, creating a significant security exposure that can be exploited by malicious actors to access sensitive server resources.
The vulnerability operates through the exploitation of the LIBXML_NOENT flag which, when improperly configured, allows attackers to manipulate XML parsing behavior to include external entity references. This configuration enables attackers to craft malicious XML payloads that, when processed by the vulnerable simplexml_load_string() function, can result in arbitrary file reading capabilities on the target server. The flaw specifically affects the XML processing libraries used within the Chamilo LMS platform, allowing unauthorized access to server files that should remain protected.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with the ability to read arbitrary files from the server filesystem. This capability can lead to the exposure of sensitive configuration files, database credentials, application source code, and potentially user data. The vulnerability affects the core functionality of the learning management system and can compromise the integrity of the entire platform, making it a critical concern for educational institutions relying on Chamilo LMS for their digital learning infrastructure. Attackers can leverage this vulnerability to gain unauthorized access to the underlying server environment and potentially escalate their privileges within the system.
Security mitigations for this vulnerability involve upgrading to the patched versions 1.11.38 and 2.0.0-RC.3 where the XXE protection has been properly implemented. Organizations should also implement additional security measures such as disabling the LIBXML_NOENT flag in XML processing functions, implementing proper input validation for all XML data, and configuring XML parsers with appropriate security restrictions. The vulnerability aligns with CWE-611 (Improper Restriction of XML External Entity Reference) and maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: Python) in scenarios where attackers might leverage the file reading capability to obtain system information or credentials. System administrators should also consider implementing network segmentation, firewall rules to restrict access to XML processing endpoints, and regular security audits to identify potential XXE vulnerabilities in other applications within their infrastructure.