Executive brief
Chamilo LMS, a popular open-source learning management system used by educational institutions and businesses, is vulnerable to a security flaw in how it processes XML data. An attacker with basic user permissions could exploit this to read sensitive files directly from the server's file system. This could lead to the exposure of configuration files, system credentials, or other private data, potentially compromising the entire server.
Technical details
Chamilo LMS is vulnerable to XML External Entity (XXE) injection due to the insecure use of the simplexml_load_string() PHP function without proper protection against external entity resolution. The vulnerability exists in multiple components, including exercise imports, LTI form processing, and the BigBlueButton (BBB) plugin. An attacker with low-level authenticated access can submit a specially crafted XML payload that, when processed with the LIBXML_NOENT flag or specific libxml configurations, allows for arbitrary server-side file disclosure. This issue is addressed in versions 1.11.38 and 2.0.0-RC.3 by implementing LIBXML_NONET and improved error handling during XML parsing.
Affected products
- Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed
- 2026-04-16: other: NVD analysis completed