CVE-2026-34160 - Vulnerability Analysis

Overview

Chamilo LMS < 2.0.0-RC.3 contains an unauthenticated server-side request forgery caused by lack of filtering on user-controlled package-url parameter in PENS plugin endpoint, letting attackers probe internal services and steal sensitive metadata, exploit requires no authentication.

Severity & Score

Impact

Attackers can access internal network services and sensitive cloud metadata, potentially leading to credential theft and unauthorized internal operations.

Mitigation

Upgrade to version 2.0.0-RC.3 or later.

References

• https://github.com/chamilo/chamilo-lms/commit/de4058d76fac2413afd023b1ec942e8e79579011
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g2xj-4cch-j276

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner