CVE-2025-50199 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains a server side request forgery caused by blind SSRF in /index.php via the POST openid_url parameter, letting remote attackers make arbitrary requests, exploit requires crafted POST request.

Severity & Score

Impact

Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or causing other impacts.

Mitigation

Upgrade to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-jv2w-m5r6-p52h

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner