PT-2026-32020 · Unknown · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-33705

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38

Description Chamilo LMS, a learning management system, allows direct access to Twig template files (.tpl) located under /main/template/default/ without authentication via HTTP GET requests. These files expose internal application logic, variable names, AJAX endpoint URLs, and the admin panel structure.

Recommendations Update to version 1.11.38 or later.

Fix

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2026-33705

Affected Products

Chamilo Lms

References · 5

• https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33705 · Security Note
• https://twitter.com/CVEnew/status/2042710196028367141 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042751247208366495 · Twitter Post