CVE-2026-33715

Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3.

• CWE-306
• CWE-918

• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mxc9-9335-45mcVendor Advisory

Published

Apr 14, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3371The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2026-33710Chamilo LMS is a learning management system. Prior to 1.11.3…7.5
• CVE-2026-33711Incus is a system container and virtual machine manager. Inc…7.8
• CVE-2026-33712Typebot is a chatbot builder tool. In versions 3.15.2 and pr…10
• CVE-2026-33713n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33714Chamilo is an open-source learning management system (LMS). …7.2
• CVE-2026-33716WWBN AVideo is an open source video platform. In versions up…9.4
• CVE-2026-33717WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33718OpenHands is software for AI-driven development. Starting in…9.9
• CVE-2026-33719WWBN AVideo is an open source video platform. In versions up…8.6
• CVE-2026-33720n8n is an open source workflow automation platform. Prior to…4.2
• CVE-2026-33721MapServer is a system for developing web-based GIS applicati…7.5