Is CVE-2026-33737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33737 being exploited in the wild.

How severe is CVE-2026-33737?

Medium severity, with a CVSS score of 5.3, published 10 April 2026.

Which products and versions are affected?

Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3.

Is there a fix for CVE-2026-33737?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33737 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33737?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33737: Chamilo LMS XML External Entity injection in multiple components

Q: Which products and versions are affected?

Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3.

Q: Is there a fix for CVE-2026-33737?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-33737 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33737?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33737 · Severity: medium · CVSS 5.3 · Published 2026-04-10

Chamilo LMS, a popular open-source learning management system used by educational institutions and businesses, is vulnerable to a security flaw in how it processes XML data. An attacker with basic user permissions could exploit this to read sensitive files directly from the server's file system. This could lead to the exposure of configuration files, system credentials, or other private data, potentially compromising the entire server.

Quick answers

Is CVE-2026-33737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33737 being exploited in the wild.
How severe is CVE-2026-33737?: Medium severity, with a CVSS score of 5.3, published 10 April 2026.
Which products and versions are affected?: Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3.
Is there a fix for CVE-2026-33737?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33737 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33737?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Chamilo LMS is vulnerable to XML External Entity (XXE) injection due to the insecure use of the simplexml_load_string() PHP function without proper protection against external entity resolution. The vulnerability exists in multiple components, including exercise imports, LTI form processing, and the BigBlueButton (BBB) plugin. An attacker with low-level authenticated access can submit a specially crafted XML payload that, when processed with the LIBXML_NOENT flag or specific libxml configurations, allows for arbitrary server-side file disclosure. This issue is addressed in versions 1.11.38 and 2.0.0-RC.3 by implementing LIBXML_NONET and improved error handling during XML parsing.

Affected products

Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3

Timeline

2026-04-10: advisory: Vendor advisory published on GitHub
2026-04-10: disclosed
2026-04-16: other: NVD analysis completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.