CVE-2026-34160: Chamilo LMS SSRF Vulnerability

CVE-2026-34160 Overview

CVE-2026-34160 is a Server-Side Request Forgery (SSRF) vulnerability in Chamilo LMS, an open-source learning management system. The vulnerability exists in the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php, which is accessible without authentication and accepts a user-controlled package-url parameter. The server fetches this URL using curl without filtering private or internal IP addresses, enabling unauthenticated SSRF attacks.

Critical Impact

This vulnerability allows unauthenticated attackers to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters.

Affected Products

• Chamilo LMS versions prior to 2.0.0-RC.3
• Chamilo LMS PENS plugin (public/plugin/Pens/pens.php)
• Chamilo LMS deployments with the PENS plugin enabled

Discovery Timeline

• April 14, 2026 - CVE-2026-34160 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34160

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The PENS plugin endpoint in Chamilo LMS exposes critical functionality without requiring authentication, and fails to validate that user-supplied URLs do not point to internal or private network addresses. This combination creates a significant attack surface where external attackers can leverage the server as a proxy to access internal resources.

The attack surface is particularly dangerous because:

1. No authentication is required to access the vulnerable endpoint
2. The server-side curl implementation follows redirects without restriction
3. Both the package-url parameter and callback parameters (receipt, alerts) are vulnerable
4. Cloud environments are especially at risk due to metadata endpoint exposure

Root Cause

The root cause is the absence of URL validation in the PensProcessor.php class. The original implementation used isAllowedDownloadUrl() which did not perform adequate checks against private or internal IP addresses. The vulnerable code allowed arbitrary URLs to be fetched by the server without validating whether the target address was internal, private, or otherwise restricted.

Attack Vector

An attacker can exploit this vulnerability by sending a crafted request to the PENS plugin endpoint with a malicious package-url parameter pointing to internal resources. The network-based attack vector requires no authentication or user interaction, making it highly exploitable from the internet.

Example attack scenarios include:

• Accessing AWS/GCP/Azure metadata endpoints at http://169.254.169.254/latest/meta-data/ to steal IAM credentials
• Scanning internal network services to map infrastructure
• Triggering state-changing operations on internal APIs via callback parameters
• Exfiltrating sensitive data from internal services

             throw new PENSException(1322);
         }
 
-        if (!$this->isAllowedDownloadUrl($request->getPackageUrl())) {
+        if (!$this->isAllowedPackageUrl($request->getPackageUrl())) {
             error_log('[Pens][collectPackage] download url rejected');
             throw new PENSException(1301);
         }

Source: GitHub Commit Update

The patch replaces isAllowedDownloadUrl() with a stricter isAllowedPackageUrl() function that enforces proper validation against private and internal IP addresses.

Detection Methods for CVE-2026-34160

Indicators of Compromise

• Unexpected HTTP requests originating from the Chamilo server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) from the web server
• Anomalous traffic patterns from the Chamilo application to non-standard ports on internal hosts
• Access logs showing requests to /plugin/Pens/pens.php with suspicious package-url parameters

Detection Strategies

• Monitor web server access logs for requests to the PENS endpoint (/plugin/Pens/pens.php) with unusual URL parameters
• Implement network-level detection for outbound connections from web servers to private IP ranges
• Deploy web application firewall (WAF) rules to detect and block SSRF patterns in URL parameters
• Configure alerts for any access to cloud metadata endpoints from application servers

Monitoring Recommendations

• Enable detailed logging for the Chamilo PENS plugin to capture all incoming requests
• Implement egress filtering rules to prevent the web server from connecting to internal networks
• Monitor for DNS lookups to internal hostnames or metadata service addresses
• Review network traffic patterns for unusual connections initiated by the Chamilo application

How to Mitigate CVE-2026-34160

Immediate Actions Required

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later immediately
• If immediate upgrade is not possible, disable or remove the PENS plugin by removing or restricting access to public/plugin/Pens/
• Implement network-level egress filtering to prevent the server from connecting to internal IP ranges
• Review server logs for evidence of exploitation attempts

Patch Information

The vulnerability has been fixed in Chamilo LMS version 2.0.0-RC.3. The patch introduces stricter URL validation logic in the PensProcessor.php class, replacing the isAllowedDownloadUrl() method with isAllowedPackageUrl() to ensure proper filtering of private and internal IP addresses.

Patch resources:

• GitHub Release v2.0.0-RC.3
• GitHub Security Advisory GHSA-g2xj-4cch-j276
• GitHub Commit Update

Workarounds

• Disable the PENS plugin if not required for your deployment
• Implement web server or reverse proxy rules to block access to /plugin/Pens/pens.php
• Configure firewall rules to prevent outbound connections from the web server to internal networks and cloud metadata endpoints
• Deploy a WAF rule to block requests containing internal IP addresses or metadata endpoint URLs in parameters

# Configuration example
# Block access to PENS plugin using nginx
location /plugin/Pens/ {
    deny all;
    return 403;
}

# Alternative: Block metadata endpoint access at firewall level
iptables -A OUTPUT -d 169.254.169.254 -j DROP