SimpleXML is used to parse XML without protection, allowing a crafted XML document to request any file on the server through the LIBXML_NOENT flag. This flaw can expose sensitive configuration files, source code, or other private data and is classified as CWE‑611, XML External Entity Injection.

Chamilo Learning Management System – versions earlier than 1.11.38 and 2.0.0‑RC.3 are affected. Any installation that processes XML with simplexml_load_string is vulnerable, regardless of the deployment environment.

The CVSS score of 5.3 reflects a moderate severity, primarily due to the potential for information disclosure. Exploitation requires sending a malicious XML payload to the LMS; the attack vector is inferred to be remote via network if the LMS exposes any XML processing endpoints. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation but still requiring prompt remediation.