What is the CVSS score of CVE-2026-33715?

CVE-2026-33715 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33715?

Chamilo LMS 2.0-RC.2 contains an unauthenticated SSRF vulnerability in the installation module that could allow attackers to abuse the system as an email relay and scan internal networks without…. A patch is available.

How to fix or mitigate CVE-2026-33715?

Within 24 hours: Identify all Chamilo LMS 2.0-RC.2 instances in your environment and restrict network access to install.ajax.php. Within 7 days: Upgrade to Chamilo LMS 2.0.0-RC.3 or later. Within 30 days: Verify upgrade completion across all instances and confirm install.ajax.php is inaccessible from untrusted networks via firewall or WAF rules.

PHP CVE-2026-33715

EUVD-2026-22710 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-04-14 GitHub_M

Authentication Bypass PHP SSRF

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:56 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0-RC.3

Analysis Generated

Apr 14, 2026 - 22:39 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 21:16 euvd

EUVD-2026-22710

Analysis Generated

Apr 14, 2026 - 21:16 vuln.today

CVE Published

Apr 14, 2026 - 21:05 nvd

HIGH 7.2

DescriptionGitHub Advisory

Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3.

AnalysisAI

Server-Side Request Forgery (SSRF) in Chamilo LMS 2.0-RC.2 allows unauthenticated remote attackers to weaponize the learning management system as an open email relay and probe internal networks. The vulnerability stems from an authentication bypass in install.ajax.php, which accepts arbitrary SMTP server connections via Symfony Mailer DSN strings. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L). EPSS data not provided. Vendor-released patch: version 2.0.0-RC.3.

Technical ContextAI

Chamilo LMS is an open-source PHP-based learning management platform. The vulnerability (CWE-306: Missing Authentication for Critical Function) exists in the public/main/inc/ajax/install.ajax.php endpoint, which uniquely fails to include the global.inc.php initialization file that enforces authentication and installation-completion checks across other AJAX endpoints. The test_mailer action within this script accepts POST-supplied Symfony Mailer DSN (Data Source Name) strings - connection URIs defining transport protocols, credentials, and endpoints for email delivery. By submitting arbitrary DSN values, attackers can force the server to initiate SMTP connections to attacker-controlled or internal network destinations, constituting a classic Server-Side Request Forgery attack vector. The affected product is identified as cpe:2.3:a:chamilo:chamilo-lms, specifically version 2.0-RC.2, part of the PHP-based educational technology stack.

RemediationAI

Immediately upgrade to Chamilo LMS version 2.0.0-RC.3 or later, released specifically to address this vulnerability. The patch is available at https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3. If immediate patching is not feasible, implement workarounds including: restrict network-level access to the /public/main/inc/ajax/install.ajax.php endpoint via web application firewall rules or web server configuration (deny all access or limit to trusted administrator IPs), disable or remove the install.ajax.php file if installation procedures are complete, and monitor outbound SMTP connections for unexpected destinations. Review server logs for POST requests to install.ajax.php with test_mailer actions to identify potential exploitation attempts. Detailed mitigation guidance is available in the GitHub security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mxc9-9335-45mc.