What is the CVSS score of CVE-2026-34160?

CVE-2026-34160 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-34160?

Chamilo LMS versions before 2.0.0-RC.3 contain an unauthenticated server-side request forgery vulnerability that enables attackers to access internal cloud metadata and network services, including…. A patch is available.

How to fix or mitigate CVE-2026-34160?

Within 24 hours: Identify all Chamilo LMS deployments and verify version numbers (vulnerable if prior to 2.0.0-RC.3); disable or restrict network access to the PENS plugin if immediate patching is not feasible. Within 7 days: upgrade all Chamilo instances to version 2.0.0-RC.3 or later per vendor advisory. Within 30 days: audit access logs for unauthorized requests to package-url parameters and validate that internal metadata endpoints (169.254.169.254) are not accessible from the LMS application layer.

PHP CVE-2026-34160

EUVD-2026-22712 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-04-14 GitHub_M

Authentication Bypass PHP SSRF Microsoft

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:56 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0-RC.3

Analysis Generated

Apr 14, 2026 - 22:39 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 21:16 euvd

EUVD-2026-22712

Analysis Generated

Apr 14, 2026 - 21:16 vuln.today

CVE Published

Apr 14, 2026 - 21:09 nvd

HIGH 8.6

DescriptionGitHub Advisory

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3.

AnalysisAI

Unauthenticated Server-Side Request Forgery (SSRF) in Chamilo LMS versions prior to 2.0.0-RC.3 allows remote attackers to access internal network services and cloud metadata endpoints via unfiltered package-url parameter in the PENS plugin. Attackers can steal AWS IAM credentials from 169.254.169.254, probe internal infrastructure, and trigger state-changing operations on internal services without requiring authentication. CVSS 8.6 (High) with Changed Scope reflects the ability to pivot from the LMS to other internal systems. No public exploit identified at time of analysis, though the attack vector is straightforward requiring only HTTP requests to the exposed endpoint.

Technical ContextAI

The vulnerability exists in the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php within Chamilo LMS (cpe:2.3:a:chamilo:chamilo-lms), an open-source PHP-based learning management system. The endpoint uses PHP's curl library to fetch resources from user-controlled package-url parameters without validating destination addresses or implementing SSRF protections. This represents a CWE-306 (Missing Authentication for Critical Function) weakness, as the PENS endpoint processes network requests that should require authentication but are exposed publicly. The vulnerability is compounded by the presence of receipt and alerts callback parameters that can trigger state-changing operations on targeted internal services. Cloud deployments are particularly vulnerable as attackers can access instance metadata services (169.254.169.254 for AWS, similar endpoints for Azure/GCP) which typically expose IAM credentials, instance configuration, and user-data scripts.

RemediationAI

Upgrade to Chamilo LMS version 2.0.0-RC.3 or later, which includes the security fix committed in de4058d76fac2413afd023b1ec942e8e79579011. The patch implements proper input validation and SSRF protections for the package-url parameter in the PENS plugin endpoint. Organizations can download the patched release from https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3. For environments unable to immediately upgrade, disable the PENS plugin entirely or implement network-level controls blocking the LMS from accessing internal IP ranges (RFC 1918 addresses 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, link-local 169.254.0.0/16, and loopback 127.0.0.0/8) and cloud metadata endpoints at the firewall or web application firewall layer. Review application logs for suspicious requests to public/plugin/Pens/pens.php with package-url parameters containing internal IP addresses or metadata service endpoints.