Chamilo LMS, an open-source learning management system, has a critical vulnerability (CVE-2026-34160) in versions before 2.0.0-RC.3. The PENS plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-supplied package-url parameter. The server fetches this URL using curl without filtering private or internal IP addresses, enabling unauthenticated SSRF attacks. Attackers can leverage this to access internal network resources, cloud metadata services (e.g., 169.254.169.254), potentially stealing IAM credentials and sensitive instance metadata or triggering state-changing operations via callback parameters. This significantly increases the attack surface due to the lack of authentication. The vulnerability is addressed in version 2.0.0-RC.3.

The vulnerability allows unauthenticated attackers to perform SSRF attacks, potentially accessing sensitive internal network services and cloud metadata endpoints. This can lead to theft of IAM credentials and sensitive instance metadata or manipulation of internal services through state-changing callbacks. The CVSS score of 8.6 indicates a high severity impact with network attack vector, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact.

A fix is available in Chamilo LMS version 2.0.0-RC.3. Users should upgrade to this version or later to remediate the vulnerability. Until upgraded, restrict access to the vulnerable endpoint and monitor for suspicious activity related to SSRF attempts. Patch status is confirmed by the vendor's version release notes indicating the issue is fixed in 2.0.0-RC.3.