CVE-2026-33715: Chamilo LMS SSRF Vulnerability

CVE-2026-33715 Overview

CVE-2026-33715 is a Server-Side Request Forgery (SSRF) vulnerability affecting Chamilo LMS, an open-source learning management system. The vulnerability exists in version 2.0-RC.2 where the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances. Unlike other AJAX endpoints in Chamilo, this file does not include the global.inc.php file that performs authentication and installation-completed checks, leaving it exposed to unauthenticated access.

The test_mailer action within this endpoint accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server. This enables SSRF into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this vulnerability to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address.

Critical Impact

This vulnerability allows unauthenticated attackers to perform SSRF attacks against internal network resources, abuse the server as an open mail relay for phishing campaigns, and potentially disclose internal network topology through error messages.

Affected Products

• Chamilo LMS version 2.0-RC.2

Discovery Timeline

• April 14, 2026 - CVE CVE-2026-33715 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33715

Vulnerability Analysis

This vulnerability stems from missing authentication checks (CWE-306) on a sensitive AJAX endpoint. The install.ajax.php file was likely intended to be used only during the installation process but remains accessible after installation is complete. Because this file does not include the standard authentication bootstrap (global.inc.php), any unauthenticated user can invoke its functionality.

The test_mailer action is particularly dangerous as it accepts a Symfony Mailer DSN (Data Source Name) string that defines the SMTP server connection parameters. By supplying a malicious DSN pointing to an attacker-controlled or internal SMTP server, an attacker can force the Chamilo server to initiate outbound connections to arbitrary hosts on the SMTP port.

Root Cause

The root cause is the failure to include proper authentication and installation-status validation in the install.ajax.php AJAX endpoint. While other AJAX endpoints in Chamilo LMS include global.inc.php to verify user authentication and confirm the installation is complete, this particular file bypasses those security checks entirely. This oversight allows any external user to access installation-related functionality that should be restricted or removed after deployment.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send a crafted POST request to the vulnerable endpoint with a malicious Symfony Mailer DSN string. The attack can be used in multiple ways:

1. SSRF to Internal Networks: By specifying an internal SMTP server address in the DSN, attackers can probe internal network infrastructure and potentially interact with internal mail services.

2. Open Mail Relay Abuse: Attackers can configure the DSN to use external SMTP servers they control, effectively turning the Chamilo server into a mail relay. Emails sent this way appear to originate from the Chamilo server's IP address, lending legitimacy to phishing or spam campaigns.

3. Information Disclosure: Error responses from failed SMTP connection attempts may reveal details about internal network topology, running services, and firewall configurations.

The vulnerability is accessible through the public/main/inc/ajax/install.ajax.php endpoint by invoking the test_mailer action with attacker-controlled SMTP configuration data.

Detection Methods for CVE-2026-33715

Indicators of Compromise

• Unusual HTTP POST requests to /main/inc/ajax/install.ajax.php from external IP addresses
• Web server logs showing access to the test_mailer action on installed Chamilo instances
• Unexpected outbound SMTP connections from the Chamilo web server to unfamiliar IP addresses
• Increased email delivery reports or bounce-backs from emails not legitimately sent by the organization

Detection Strategies

• Monitor web server access logs for requests to install.ajax.php endpoints on production Chamilo instances
• Implement network monitoring to detect outbound SMTP traffic originating from web application servers that should not be sending email directly
• Deploy Web Application Firewall (WAF) rules to block unauthenticated access to installation-related endpoints
• Use SentinelOne Singularity XDR to detect anomalous network behavior patterns indicative of SSRF exploitation

Monitoring Recommendations

• Configure alerting for any access attempts to /main/inc/ajax/install.ajax.php on production systems
• Monitor outbound network connections from the Chamilo server, particularly on port 25 (SMTP) and related mail ports (465, 587)
• Review email server logs for unusual relay attempts or emails sent from unexpected sources
• Implement network segmentation monitoring to detect SSRF attempts reaching internal resources

How to Mitigate CVE-2026-33715

Immediate Actions Required

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later immediately
• If immediate upgrade is not possible, restrict access to the install.ajax.php file at the web server level
• Review web server logs to identify any potential exploitation attempts
• Audit outbound network traffic from the Chamilo server for signs of abuse

Patch Information

The vulnerability has been fixed in Chamilo LMS version 2.0.0-RC.3. Users should upgrade to this version or later to remediate the vulnerability. The fix ensures that the installation AJAX endpoint is properly protected and inaccessible on fully installed instances.

For detailed patch information, see the GitHub Release v2.0.0-RC.3 and the GitHub Security Advisory GHSA-mxc9-9335-45mc.

Workarounds

• Block access to public/main/inc/ajax/install.ajax.php at the web server level using location-based access controls
• Implement network egress filtering to restrict outbound SMTP connections from the web application server
• Deploy a Web Application Firewall (WAF) rule to block POST requests to installation-related endpoints
• Consider removing or renaming the install.ajax.php file if the installation process is complete and the file is no longer needed

# Apache configuration example to block access to the vulnerable endpoint
<Location "/main/inc/ajax/install.ajax.php">
    Require all denied
</Location>

# Nginx configuration example
location = /main/inc/ajax/install.ajax.php {
    deny all;
    return 403;
}