PT-2026-32915 · Unknown · Chamilo Lms

Romain-Deperne · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-33715

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 2.0-RC.2

Description The file 'public/main/inc/ajax/install.ajax.php' is accessible without authentication on fully installed instances because it lacks the inclusion of the global.inc.php file, which handles authentication and installation checks. The test mailer action accepts an arbitrary Symfony Mailer DSN string via POST data to connect to a specified SMTP server. This allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is induced to make requests to internal network resources, via the SMTP protocol. This can be used to turn the server into an open email relay for phishing and spam, or to disclose internal network topology and running services through error responses from failed connections.

Recommendations Update version 2.0-RC.2 to version 2.0.0-RC.3.

Fix

Missing Authentication

SSRF

Weakness Enumeration

CWE-306

CWE-918

Related Identifiers

CVE-2026-33715

Affected Products

Chamilo Lms

References · 4

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mxc9-9335-45mc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33715 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 · Note
• https://twitter.com/CVEnew/status/2044338929080631494 · Twitter Post