What is CVE-2026-33705?

CVE-2026-33705 is a medium-severity vulnerability in Chamilo Chamilo-Lms, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 5.3/10. Published 2026-04-10.

How severe is CVE-2026-33705?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Chamilo Chamilo-Lms

CVE-2026-33705

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

EPSS: 0.002 (15.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Chamilo Chamilo-lms — versions < 1.11.38
Chamilo Chamilo_lms

Weakness classification (CWE)

CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-33705?: CVE-2026-33705 is a medium-severity vulnerability in Chamilo Chamilo-Lms, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 5.3/10. Published 2026-04-10.
How severe is CVE-2026-33705?: Medium severity. CVSS v3 base score is 5.3 out of 10.