Chamilo LMS SSRF Flaw: Unauthenticated Email Relay Risk

The National Vulnerability Database (NVD) has documented CVE-2026-33715, a high-severity vulnerability impacting Chamilo LMS, an open-source learning management system. Specifically, version 2.0-RC.2 contains a critical flaw in the public/main/inc/ajax/install.ajax.php file. This endpoint, unlike others, lacks proper authentication and installation-completed checks because it fails to include the global.inc.php file.

This oversight allows unauthenticated attackers to leverage the test_mailer action. According to the NVD, this action accepts an arbitrary Symfony Mailer DSN string via POST data, which is then used to connect to an attacker-specified SMTP server. This opens the door to Server-Side Request Forgery (SSRF) into internal networks using the SMTP protocol. Beyond network traversal, an unauthenticated attacker can weaponize affected Chamilo servers as open email relays for phishing and spam campaigns, with emails appearing to originate from the server’s IP. Furthermore, failed SMTP connection error responses could inadvertently disclose sensitive information about the internal network topology and running services. The NVD confirms this issue has been patched in version 2.0.0-RC.3.