Unauthenticated SSRF in Chamilo LMS Plugin Affects Internal Network Security
CVE-2026-34160
Key Information:
- Vendor
Chamilo
- Status
- Vendor
- CVE Published:
- 14 April 2026
Badges
What is CVE-2026-34160?
The Chamilo LMS is affected by a security issue in its PENS plugin, allowing unauthenticated access to an endpoint that fetches user-controlled URLs. Malicious actors can leverage this vulnerability to probe internal network services, access sensitive cloud metadata endpoints, and manipulate internal services without authentication. This considerable flaw in security architecture heightens the possibilities for unauthorized access and data leaks, making it essential for users to update to version 2.0.0-RC.3 or later to mitigate these risks.
Affected Version(s)
chamilo-lms < 2.0-RC.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.