admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
chamilo chamilo