What is the CVSS score of CVE-2026-33705?

CVE-2026-33705 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33705?

Yes, a patch is available for CVE-2026-33705. Update the affected software to the latest version immediately.

Chamilo Lms CVE-2026-33705

EUVD-2026-21557 MEDIUM

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-04-10 security-advisories@github.com

Information Disclosure Chamilo Lms

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38

EUVD ID Assigned

Apr 10, 2026 - 19:22 euvd

EUVD-2026-21557

Analysis Generated

Apr 10, 2026 - 19:22 vuln.today

CVE Published

Apr 10, 2026 - 19:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

AnalysisAI

Chamilo LMS versions prior to 1.11.38 expose Twig template files (.tpl) in the /main/template/default/ directory to unauthenticated HTTP GET requests, allowing remote attackers to disclose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure without authentication. This information disclosure vulnerability has a CVSS score of 5.3 with confirmed patch availability in version 1.11.38.

Technical ContextAI

Chamilo LMS uses Twig templating engine for dynamic content rendering. Template files (.tpl) located in /main/template/default/ are intended for server-side processing and contain embedded application logic, variable references, and API endpoints. The vulnerability arises from inadequate web server access controls or framework routing logic that fails to restrict direct HTTP access to these template files. CWE-538 (Information Exposure Through Persistent Cookies) is referenced, though the root cause appears to be improper directory/file access controls rather than cookie-specific exposure. Attackers can simply request template files via standard HTTP GET, bypassing the authentication mechanisms that protect compiled or rendered output. The exposure of AJAX endpoint URLs and admin panel structure significantly increases the attack surface for secondary exploitation (privilege escalation, CSRF, XSS, or other attacks targeting identified endpoints).

RemediationAI

Upgrade Chamilo LMS to version 1.11.38 or later, which includes access control fixes preventing direct HTTP access to template files in /main/template/default/. Install the patched version by downloading the release from the official GitHub repository (https://github.com/chamilo/chamilo-lms) or applying the security advisory patch documented at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5wjg-8x28-px57. As an interim workaround pending patch deployment, configure your web server (Apache/Nginx) to block direct requests to .tpl files by implementing access control rules (e.g., Apache .htaccess or Nginx location blocks) that deny GET/HEAD requests to /main/template/default/*.tpl and similar template directories. Verify remediation by attempting to fetch a template file directly (e.g., http://your-chamilo-instance/main/template/default/index.tpl) and confirming a 403 Forbidden response.