CVE-2026-33705

MEDIUM5.3

Chamilo LMS has unauthenticated access to Twig template source files exposes application logic

Published Apr 10, 2026

Modified 1 weeks ago

Details

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

References

WEB

https://github.com/chamilo/chamilo-lms/commit/4efb5ee8ed849ca147ca1fe7472ef7b98db17bff

WEB

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-33705

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector