PT-2026-32916 · Unknown · Chamilo Lms

Romain-Deperne · CVE-2026-34160 · Published 2026-04-14 · Updated 2026-04-15

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description The PENS (Package Exchange Notification Services) plugin endpoint ''public/plugin/Pens/pens.php'' is accessible without authentication. It accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling Server-Side Request Forgery (SSRF). SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unexpected destination. An attacker can use this to probe internal network services, access cloud metadata endpoints to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters.

Recommendations Update to version 2.0.0-RC.3.

Exploit

Fix

Missing Authentication

SSRF

Weakness Enumeration

CWE-306

CWE-918

Related Identifiers

CVE-2026-34160

GHSA-G2XJ-4CCH-J276

Affected Products

Chamilo Lms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34160.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g2xj-4cch-j276 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/de4058d76fac2413afd023b1ec942e8e79579011 · Patch
• https://osv.dev/vulnerability/CVE-2026-34160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34160 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 · Note
• https://twitter.com/CVEnew/status/2044338927960739940 · Twitter Post