Chamilo Lms EUVD-2026-21569

The CVSS v3.1 score of 5.3 reflects a moderate-severity vulnerability: network-accessible attack vector, low privilege requirement (PR:L), high confidentiality impact (C:H), but no integrity or availability impact. The attack complexity is high (AC:H), suggesting non-trivial exploitation conditions-likely requiring knowledge of valid file paths or successful XXE payload crafting. EPSS score and active exploitation status (KEV) data were not provided; however, the requirement for authenticated access (PR:L) significantly reduces real-world risk compared to unauthenticated XXE vulnerabilities. The presence of upstream commits addressing the issue and availability of patched versions (1.11.38, 2.0.0-RC.3) indicates vendor responsiveness. This is a legitimate information disclosure risk primarily affecting confidentiality in multi-tenant or high-security deployments, but the authentication barrier and high attack complexity place it below critical priority for many organizations. Organizations with strict file access controls or those running air-gapped instances face lower risk.

An authenticated user with legitimate access to Chamilo LMS (such as an instructor or student) crafts a malicious XML payload containing an XXE payload referencing a sensitive file (e.g., /etc/passwd or database configuration files). By uploading or injecting this XML through a feature that processes XML via simplexml_load_string(), the attacker triggers entity expansion, and the server returns the file contents embedded in the application response or logs, disclosing sensitive information. No public exploit code has been identified; successful exploitation requires knowledge of vulnerable code paths and valid file paths on the target system.