CVE-2025-50199 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains a server side request forgery caused by blind SSRF in /index.php via the POST openid_url parameter, letting remote attackers make arbitrary requests, exploit requires crafted POST request.

Severity & Score

Impact

Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or causing other impacts.

Mitigation

Upgrade to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-jv2w-m5r6-p52h

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2025-50199 - Critical (9.1) Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50199/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner