Unauthenticated SSRF in Chamilo LMS Plugin Affects Internal Network Security

CVE-2026-34160

What is CVE-2026-34160?

The Chamilo LMS is affected by a security issue in its PENS plugin, allowing unauthenticated access to an endpoint that fetches user-controlled URLs. Malicious actors can leverage this vulnerability to probe internal network services, access sensitive cloud metadata endpoints, and manipulate internal services without authentication. This considerable flaw in security architecture heightens the possibilities for unauthorized access and data leaks, making it essential for users to update to version 2.0.0-RC.3 or later to mitigate these risks.

References