CVE-2026-33715
7.2 · High
Unauthenticated SSRF and open mail relay in Chamilo LMS through install.ajax.php
A leftover installer endpoint in Chamilo LMS 2.0 let anyone make the server open SMTP connections to any host and send mail through it.
Vulnerability class
Missing authentication
Sensitive endpoints reachable without a session.
2 write-ups, 2 vulnerabilities
CVE-2026-34160
8.6 · HighUnauthenticated SSRF in the Chamilo LMS PENS plugin through package and callback URLs
The PENS endpoint of Chamilo LMS 2.0 fetched package URLs and posted callbacks to addresses chosen by anyone, internal hosts and cloud metadata included.
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-34160 | Chamilo LMS | Unauthenticated SSRF through PENS package and callback URLs | 8.6 High | |
| CVE-2026-33715 | Chamilo LMS | Unauthenticated SSRF and mail relay through test_mailer | 7.2 High |