Auth bypass in Chamilo Chamilo-Lms
CVE-2026-34160
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (45.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.006 · change: +0.002
Affected products
- Chamilo Chamilo-Lms — versions < 2.0-RC.3
- Chamilo Lms — versions 2.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/chamilo/chamilo-lms/security/advisories/GHSA-g2xj-4cch-j276 (Vendor Advisory)
- github.com/chamilo/chamilo-lms/commit/de4058d76fac2413afd023b1ec942e8e79579011 (Patch)
- github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-34160?
- CVE-2026-34160 is a high-severity vulnerability in Chamilo Chamilo-Lms, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2026-04-14.
- How severe is CVE-2026-34160?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2026-34160 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.