PT-2026-32020 · Unknown · Chamilo Lms

CVE-2026-33705 · Published 2026-04-10 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38

Description Chamilo LMS, a learning management system, allows direct access to Twig template files (.tpl) located under /main/template/default/ without authentication via HTTP GET requests. These files expose internal application logic, variable names, AJAX endpoint URLs, and the admin panel structure.

Recommendations Update to version 1.11.38 or later.

Exploit

Fix

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2026-33705

GHSA-5WJG-8X28-PX57

Affected Products

Chamilo Lms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33705.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33705 · Security Note
• https://twitter.com/VulmonFeeds/status/2042751247208366495 · Twitter Post
• https://twitter.com/CVEnew/status/2042710196028367141 · Twitter Post