CVE-2026-34160: 
Chamilo vulnerability analysis and mitigation

CVE-2026-34160 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the PENS (Package Exchange Notification Services) plugin of Chamilo LMS. The vulnerable endpoint at public/plugin/Pens/pens.php accepts a user-controlled package-url parameter and fetches it via curl without filtering private or internal IP addresses, requiring no authentication to exploit. Affected versions include all Chamilo LMS releases up to and including 1.11.38, as well as 2.0.0-alpha1 through 2.0.0-RC.2; the issue was fixed in version 2.0.0-RC.3. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory).

The root cause is a combination of missing authentication for a critical function (CWE-306) and improper SSRF controls (CWE-918) in public/plugin/Pens/lib/PensProcessor.php. The original isAllowedDownloadUrl() and isAllowedCallbackUrl() methods only validated URL scheme and host presence but did not block private or reserved IP ranges, allowing any URL — including http://169.254.169.254/ — to be fetched by the server's curl client. Additionally, the receipt and alerts callback parameters cause the server to issue POST requests to attacker-specified URLs, enabling state-changing interactions with internal services. The fix (commit de4058d) replaced the permissive validation logic with a stricter isAllowedRemoteUrl() function that blocks private and reserved IP ranges for both download and callback URLs (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to perform internal network reconnaissance by probing services such as databases, admin panels, and internal APIs through timing and error-based side channels. In cloud-hosted deployments (AWS, GCP, Azure), attackers can reach the instance metadata service at 169.254.169.254 to steal IAM credentials, instance identity tokens, and other sensitive metadata, potentially leading to full cloud account compromise. The callback SSRF vectors via receipt and alerts parameters can additionally trigger state-changing POST requests to internal services, extending the impact beyond information disclosure (GitHub Advisory).

No public proof-of-concept exploit code was known at the time of initial disclosure, though a GitHub repository (github.com/romain-deperne/CVE-2026-34160) attributed to the reporter appeared shortly after disclosure, suggesting PoC code may now be publicly available. There is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.05%, reflecting low but non-zero exploitation probability. The zero-authentication requirement and broad version impact significantly lower the barrier for exploitation (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Chamilo LMS instances running versions ≤1.11.38 or 2.0.0-alpha1 through 2.0.0-RC.2 using search engines like Shodan or Censys, or by checking the Chamilo version disclosure on the login page.
2. Locate the vulnerable endpoint: Confirm the PENS plugin endpoint is accessible at https://<target>/public/plugin/Pens/pens.php without any authentication challenge.
3. Craft SSRF payload for metadata access: Send an HTTP GET or POST request to the endpoint with a package-url parameter pointing to the cloud metadata service, e.g.:

   GET /public/plugin/Pens/pens.php?package-url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

4. Harvest IAM credentials: Observe the server's response, which may reflect the metadata service output including IAM role names and temporary credentials (AccessKeyId, SecretAccessKey, SessionToken).
5. Internal network probing: Enumerate internal services by iterating over common internal IP ranges and ports via the package-url parameter, using response timing differences to infer open ports.
6. Callback SSRF for state-changing operations: Supply attacker-controlled internal URLs in the receipt or alerts parameters to trigger POST requests to internal services, potentially modifying state or triggering actions on unauthenticated internal APIs (GitHub Advisory).

• Network: Outbound HTTP requests from the Chamilo LMS server to 169.254.169.254 or other RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); unusual curl-initiated connections to internal hosts or metadata endpoints originating from the web server process.
• Logs: Web server access logs showing unauthenticated requests to /public/plugin/Pens/pens.php with package-url, receipt, or alerts parameters containing internal IP addresses or metadata service URLs; PHP error logs referencing [Pens][collectPackage] download url rejected (indicating blocked attempts post-patch, or absence of this message indicating pre-patch exploitation).
• File System: Unexpected files written to the Chamilo plugin directory if the SSRF was chained with a secondary attack; curl cache or temporary files containing metadata service responses.
• Process: Web server worker processes (e.g., php-fpm, apache2) spawning curl subprocesses with internal or link-local destination addresses (GitHub Advisory).

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which refactors URL validation in PensProcessor.php to block private and reserved IP ranges for both download and callback URLs (GitHub Release, GitHub Commit). All versions through 1.11.38 and 2.0.0-alpha1 through 2.0.0-RC.2 are affected and require patching. As an interim workaround, implement network-level egress filtering on the LMS server to block outbound connections to RFC-1918 addresses and the link-local range 169.254.0.0/16, and consider restricting access to the PENS plugin endpoint via web server configuration if the feature is not in use (GitHub Advisory).

The vulnerability was reported by researcher romain-deperne and published via GitHub Security Advisories by Chamilo maintainer ywarnier on April 14, 2026. The Hacker Wire covered the disclosure with a dedicated article on the unauthenticated SSRF (The Hacker Wire). No significant vendor statements beyond the GitHub advisory or notable social media debate have been identified.