CVE-2021-32925: Chamilo

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.

Affected products

• Chamilo Chamilo: from 1.11.0, up to and including 1.11.16

Published 2021-05-13. Last modified 2026-06-17.