CVE-2026-34160
Unauthenticated SSRF in Chamilo LMS PENS Plugin Enables Internal Network Access
Publication date: 2026-04-14
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | to 1.11.38 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3 in the PENS plugin endpoint located at public/plugin/Pens/pens.php. The endpoint is accessible without authentication and accepts a user-controlled package-url parameter. The server fetches the URL using curl without filtering out private or internal IP addresses, which enables an unauthenticated Server-Side Request Forgery (SSRF) attack.
An attacker can exploit this flaw to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters.
No authentication is required to exploit these SSRF vectors, which significantly increases the attack surface.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to internal network services and sensitive cloud metadata.
- Attackers can probe internal network services that are normally inaccessible from outside.
- Attackers can access cloud metadata endpoints to steal IAM credentials and sensitive instance metadata, potentially leading to further compromise of cloud resources.
- Attackers can trigger state-changing operations on internal services using the receipt and alerts callback parameters, which could disrupt normal operations.
Since no authentication is required, the risk and attack surface are significantly increased.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) to access internal network services and cloud metadata endpoints, potentially leading to the theft of IAM credentials and sensitive instance metadata.
Such unauthorized access to sensitive information could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.
Therefore, exploitation of this vulnerability may result in non-compliance with these standards due to unauthorized data exposure and insufficient access controls.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an unauthenticated SSRF in the PENS plugin endpoint at public/plugin/Pens/pens.php in Chamilo LMS versions prior to 2.0.0-RC.3. Detection can focus on identifying access attempts to this endpoint and monitoring for unusual outbound requests triggered by the package-url parameter.
You can detect attempts to exploit this vulnerability by checking web server logs for requests to the vulnerable endpoint, for example:
- grep 'public/plugin/Pens/pens.php' /var/log/apache2/access.log
- grep 'public/plugin/Pens/pens.php' /var/log/nginx/access.log
To detect SSRF activity, monitor outgoing HTTP requests from the server that include suspicious or internal IP addresses, such as 169.254.169.254 (cloud metadata endpoint). For example, using tcpdump or similar tools:
- tcpdump -i eth0 dst host 169.254.169.254 and tcp port 80
- tcpdump -i eth0 dst net 10.0.0.0/8 or dst net 192.168.0.0/16 or dst net 172.16.0.0/12
Additionally, you can use curl or similar tools to test if the endpoint is accessible without authentication:
- curl -v 'http://your-chamilo-server/public/plugin/Pens/pens.php?package-url=http://example.com'
If the server fetches the URL without authentication and allows internal IP addresses, it is vulnerable.