CVE-2026-33737: Chamilo LMS XXE Vulnerability

CVE-2026-33737 Overview

CVE-2026-33737 is an XML External Entity (XXE) vulnerability affecting Chamilo LMS, a popular open-source learning management system used by educational institutions worldwide. The vulnerability exists in multiple files that utilize the simplexml_load_string() PHP function without proper XXE protection. When the LIBXML_NOENT flag is enabled, attackers can exploit this flaw to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, and other critical information.

Critical Impact
Authenticated attackers can read arbitrary server files through XXE injection, potentially exposing sensitive configuration files, database credentials, and other confidential data stored on the Chamilo LMS server.

Affected Products

Chamilo LMS versions prior to 1.11.38
Chamilo LMS 2.0.0 Alpha 1 through Alpha 5
Chamilo LMS 2.0.0 Beta 1 through Beta 3
Chamilo LMS 2.0.0 RC1 and RC2 (prior to RC.3)

Discovery Timeline

April 10, 2026 - CVE-2026-33737 published to NVD
April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33737

Vulnerability Analysis

This XXE vulnerability arises from insecure XML parsing practices in the Chamilo LMS codebase. Multiple files within the application call the simplexml_load_string() function to parse XML data without disabling external entity processing. When combined with the LIBXML_NOENT flag, which substitutes entity references with their values, an attacker can craft malicious XML payloads that reference external entities pointing to local files on the server.

The vulnerability requires authentication to exploit, meaning an attacker needs valid credentials to an account within the Chamilo LMS instance. However, even low-privileged user accounts may be sufficient to leverage this vulnerability, as the XML parsing functions may be accessible through various application features available to standard users.

The impact is primarily focused on confidentiality, as successful exploitation allows unauthorized reading of server files but does not directly enable modification of data or denial of service conditions.

Root Cause

The root cause of this vulnerability is the improper configuration of libxml options when parsing XML input. The simplexml_load_string() function, by default, can process external entities when specific flags like LIBXML_NOENT are used. The Chamilo LMS developers did not implement the recommended security practice of disabling external entity loading using libxml_disable_entity_loader(true) (for PHP versions prior to 8.0) or by explicitly setting LIBXML_NOENT to false and using LIBXML_NOXXE flag to prevent XXE attacks.

Attack Vector

The attack is network-based and requires low-privilege authentication. An attacker with valid user credentials can inject malicious XML content through input fields or file uploads that are processed by the vulnerable simplexml_load_string() calls. The malicious XML payload contains external entity declarations that reference local files such as /etc/passwd, configuration files containing database credentials, or other sensitive system files.

When the application processes this XML, it resolves the external entity reference and includes the file contents within the parsed XML structure. The attacker can then retrieve this data through the application's response or through out-of-band exfiltration techniques using external DTDs.

Due to the authenticated nature of this vulnerability and its specific exploitation requirements, no synthetic code example is provided. For technical implementation details, refer to the GitHub Security Advisory and the associated security commits.

Detection Methods for CVE-2026-33737

Indicators of Compromise

Unusual XML payloads containing entity declarations (<!ENTITY) in application logs or request bodies
Requests containing references to sensitive system files (e.g., /etc/passwd, config.php, .env) within XML data
Out-of-band DNS or HTTP requests from the Chamilo server to attacker-controlled domains
Error messages revealing local file paths or file contents in application responses

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block XML payloads containing external entity declarations
Monitor application logs for XML parsing errors that may indicate exploitation attempts
Deploy file integrity monitoring on sensitive configuration files to detect unauthorized access patterns
Use runtime application self-protection (RASP) solutions to detect XXE exploitation in real-time

Monitoring Recommendations

Enable detailed logging for all XML parsing operations within Chamilo LMS
Monitor network traffic for unusual outbound connections from the Chamilo server that may indicate out-of-band XXE exfiltration
Implement alerting for access patterns to sensitive files referenced in XML parsing contexts
Review authentication logs for accounts making unusual requests to XML-processing endpoints

How to Mitigate CVE-2026-33737

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately
Review server logs for signs of prior exploitation attempts
Audit any sensitive files that may have been exposed and rotate credentials if necessary
Implement network segmentation to limit the impact of potential file disclosure

Patch Information

Chamilo has released security patches addressing this vulnerability. The fixes are available in versions 1.11.38 and 2.0.0-RC.3. The patches implement proper XXE protection by disabling external entity loading when parsing XML input.

Security commits:

For complete details, see the GitHub Security Advisory GHSA-c4ww-qgf2-v89j.

Workarounds

If immediate patching is not possible, implement WAF rules to block XML payloads containing external entity declarations
Restrict access to Chamilo LMS to trusted users only until patches can be applied
Deploy network-level monitoring to detect potential XXE exfiltration attempts
Consider running Chamilo in a containerized environment with restricted file system access to limit the impact of potential exploitation

bash

# Example: Verify Chamilo LMS version
cat /path/to/chamilo/app/config/configuration.php | grep -i version

# Update Chamilo to patched version (backup first)
cd /path/to/chamilo
git fetch --tags
git checkout v1.11.38  # or v2.0.0-RC.3 for 2.x branch