CVE-2026-34160
Published: 14 April 2026
Summary
CVE-2026-34160 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-4 (Information Flow Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prohibits unauthenticated access to the PENS plugin endpoint, addressing CWE-306 and preventing SSRF exploitation entirely.
Requires validation of the user-controlled package-url parameter to reject requests targeting private/internal IP addresses or cloud metadata endpoints, mitigating CWE-918 SSRF.
Enforces information flow control policies that block server-side requests to internal networks, preventing SSRF probing and state-changing operations on internal services.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SSRF in public-facing endpoint enables T1190 (exploit public app), T1046/T1018 (internal host/service scanning), T1522 (cloud metadata access), and T1552.005 (IAM credential exfil via metadata API).
NVD Description
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without…
more
filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3.
Deeper analysisAI
CVE-2026-34160 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the PENS (Package Exchange Notification Services) plugin of Chamilo LMS, an open-source learning management system. The affected endpoint, located at public/plugin/Pens/pens.php, is accessible without authentication and processes a user-controlled package-url parameter by fetching it server-side using curl. This fetch operation lacks filtering for private or internal IP addresses, allowing arbitrary network requests from the server context. The vulnerability impacts Chamilo LMS versions prior to 2.0.0-RC.3 and is rated 8.6 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), with associated CWEs-306 (Missing Authentication for Critical Function) and CWE-918 (SSRF).
Any unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to the exposed endpoint, initiating SSRF to probe internal network services or access restricted resources. Potential impacts include scanning for internal hosts, retrieving sensitive cloud instance metadata from endpoints like 169.254.169.254 to exfiltrate IAM credentials, or invoking state-changing operations on internal services through the receipt and alerts callback parameters. The lack of authentication (PR:N) combined with network accessibility (AV:N) and scope change (S:C) enables high confidentiality impacts without requiring user interaction.
The issue has been addressed in Chamilo LMS version 2.0.0-RC.3, as detailed in the project's GitHub security advisory (GHSA-g2xj-4cch-j276), release notes, and the fixing commit (de4058d76fac2413afd023b1ec942e8e79579011). Security practitioners should upgrade to the patched version and review configurations to ensure the PENS plugin endpoint is not exposed unnecessarily.
Details
- CWE(s)