CVE-2026-33715: Chamilo LMS SSRF Vulnerability

CVE-2026-33715 Overview

CVE-2026-33715 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Chamilo LMS, an open-source learning management system. The flaw resides in public/main/inc/ajax/install.ajax.php in version 2.0-RC.2. Unlike other AJAX endpoints, this file does not include global.inc.php, which performs authentication and installation-completed checks. The test_mailer action accepts an attacker-controlled Symfony Mailer DSN from POST data and uses it to connect to an arbitrary SMTP server. Attackers can pivot into internal networks, weaponize the server as an open mail relay, and harvest information from SMTP error responses. The issue is fixed in version 2.0.0-RC.3.

Critical Impact

Unauthenticated attackers can perform SSRF into internal networks, relay phishing and spam emails through the Chamilo server, and enumerate internal services via SMTP error messages.

Affected Products

• Chamilo LMS 2.0.0-RC.2
• Component: public/main/inc/ajax/install.ajax.php
• Fixed in Chamilo LMS 2.0.0-RC.3

Discovery Timeline

• 2026-04-14 - CVE-2026-33715 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-33715

Vulnerability Analysis

The vulnerability stems from missing authentication on a sensitive AJAX endpoint. In Chamilo LMS, most AJAX handlers include global.inc.php, which enforces both authentication and a check that the installer has completed. The install.ajax.php file omits this include, leaving its actions reachable on production instances without credentials.

The exposed test_mailer action is designed to validate SMTP configuration during installation. It reads a Symfony Mailer Data Source Name (DSN) string from POST input and instantiates a mailer transport that connects to the host and port specified in the DSN. Because the attacker controls the DSN, they control the outbound destination.

Three abuse paths emerge from this primitive. First, an attacker can target internal IP addresses and ports to map services behind the perimeter, using SMTP banners and error text as an oracle. Second, the attacker can supply credentials and a destination they own, turning the Chamilo server into an authenticated open relay that sends phishing or spam with the server's IP as the origin. Third, verbose SMTP error responses returned by the endpoint can leak hostnames, software banners, and topology details.

This weakness is classified as [CWE-306] Missing Authentication for Critical Function.

Root Cause

The root cause is the absence of an authentication and installation-state gate in install.ajax.php. The file dispatches actions based on a POST a parameter without verifying session state, allowing the test_mailer action to be reached anonymously on fully installed systems.

Attack Vector

Exploitation is performed over the network with no authentication and no user interaction. The attacker sends a crafted POST request to /main/inc/ajax/install.ajax.php with a=test_mailer and a Symfony Mailer DSN such as smtp://user:pass@internal-host:25 pointing at an internal address or attacker-controlled relay. The Chamilo server initiates the outbound SMTP connection and returns the result, which the attacker uses to probe networks or send mail.

No verified public proof-of-concept code is available. Technical details are documented in the GitHub Security Advisory GHSA-mxc9-9335-45mc.

Detection Methods for CVE-2026-33715

Indicators of Compromise

• Unauthenticated POST requests to /main/inc/ajax/install.ajax.php containing the parameter a=test_mailer.
• Outbound SMTP connections (TCP/25, 465, 587, 2525) originating from the Chamilo web server to unexpected internal or external hosts.
• POST bodies containing Symfony Mailer DSN strings such as smtp://, smtps://, or sendmail:// from external sources.
• Web server access logs showing repeated 200 responses to install.ajax.php after the platform installation has completed.

Detection Strategies

• Alert on any HTTP request to install.ajax.php on a production Chamilo instance, since legitimate traffic should not reach this file post-install.
• Correlate web request logs with egress firewall logs to identify SMTP connections triggered by the Chamilo PHP-FPM or Apache process.
• Inspect mail server and SPF/DMARC failure reports for messages claiming to originate from the Chamilo server's IP that were not generated by application workflows.

Monitoring Recommendations

• Capture and retain full HTTP request bodies for /main/inc/ajax/ endpoints to support post-incident analysis.
• Monitor outbound TCP connections from the web tier and baseline expected SMTP destinations.
• Forward web, firewall, and mail logs to a centralized analytics platform for cross-source correlation and retroactive hunting.

How to Mitigate CVE-2026-33715

Immediate Actions Required

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which restores the authentication and installation-completed checks on the affected endpoint.
• Block external access to /main/inc/ajax/install.ajax.php at the reverse proxy or web application firewall until patching is complete.
• Restrict outbound SMTP egress from the Chamilo web server to a known allowlist of mail relays.
• Review web and mail logs for prior exploitation attempts referencing test_mailer or unexpected DSN values.

Patch Information

The vendor has released Chamilo LMS v2.0.0-RC.3 containing the fix. Details are tracked in the GitHub Security Advisory GHSA-mxc9-9335-45mc. Administrators should apply the upgrade following the vendor's standard update procedure.

Workarounds

• Deny HTTP access to install.ajax.php via web server configuration when upgrading is not immediately possible.
• Enforce egress filtering so the web server can only reach approved SMTP destinations, neutralizing the SSRF and open-relay impact.
• Remove or rename installer files after successful deployment as a defense-in-depth measure.

# Nginx: block external access to the vulnerable installer AJAX endpoint
location = /main/inc/ajax/install.ajax.php {
    deny all;
    return 403;
}

# Apache (.htaccess) equivalent
# <Files "install.ajax.php">
#     Require all denied
# </Files>