CVE-2026-33715
7.2 · High
Unauthenticated SSRF and open mail relay in Chamilo LMS through install.ajax.php
A leftover installer endpoint in Chamilo LMS 2.0 let anyone make the server open SMTP connections to any host and send mail through it.
Vulnerability class
SSRF
The server connects to a destination the attacker chooses: internal network, cloud metadata, relays.
2 write-ups, 2 vulnerabilities
CVE-2026-34160
8.6 · HighUnauthenticated SSRF in the Chamilo LMS PENS plugin through package and callback URLs
The PENS endpoint of Chamilo LMS 2.0 fetched package URLs and posted callbacks to addresses chosen by anyone, internal hosts and cloud metadata included.
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-34160 | Chamilo LMS | Unauthenticated SSRF through PENS package and callback URLs | 8.6 High | |
| CVE-2026-33715 | Chamilo LMS | Unauthenticated SSRF and mail relay through test_mailer | 7.2 High |