Read the docs
TI-2026-24487 Aliases CVE-2026-31941

Server-Side Request Forgery (SSRF) in Chamilo LMS

Priority LOW 33CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via the social_wall_new_msg_main POST parameter and performs two server-side HTTP requests to that URL without validating whether the target is an internal or external resource. This allows an authenticated attacker to force the server to make arbitrary HTTP requests to internal services, scan internal ports, and access cloud instance metadata. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix Fixed chamilo-lms (chamilo): 1.11.38, 2.0.0-RC.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamilochamilo-lmsbefore 1.11.38; 2.0.0-alpha.1 to before 2.0.0-RC.31.11.38, 2.0.0-RC.3Patch availableCNA
  • chamilo-lms Vendorchamilo Affected before 1.11.38; 2.0.0-alpha.1 to before 2.0.0-RC.3 Fixed in 1.11.38, 2.0.0-RC.3 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*before 1.11.38Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*2.0.0 alpha1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*2.0.0 alpha2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*2.0.0 alpha3Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*2.0.0 alpha4Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*2.0.0 alpha5Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* Versions before 1.11.38 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:* Versions 2.0.0 alpha1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:* Versions 2.0.0 alpha2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:* Versions 2.0.0 alpha3 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:* Versions 2.0.0 alpha4 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:* Versions 2.0.0 alpha5 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·chamilo
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·chamilo

Remediation

  • Fix · CNA chamilo-lms (chamilo) Fixed in 1.11.38, 2.0.0-RC.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31941

References

Patch 2

Advisory 1

  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2025-32595 Chamilo: Stored XSS Vulnerability via CSV User Import CVSS 3.1HIGH 8.8
  • TI-2024-20321 Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences