Server-Side Request Forgery (SSRF) in Chamilo LMS

The SSRF vulnerability in Chamilo LMS allows an attacker to bypass security controls and interact with internal systems that are normally inaccessible from the outside. By crafting malicious URLs within the socialwallnewmsgmain POST parameter, an attacker can instruct the Chamilo LMS server to make requests to any internal service or external resource. This could lead to the exposure of sensitive data, such as cloud instance metadata, internal port scanning, and potentially even the exploitation of other vulnerabilities within the internal network. The ability to scan internal ports significantly expands the attack surface, allowing attackers to identify and target other vulnerable services.

Organizations utilizing Chamilo LMS for online learning and training are at risk, particularly those with internal services accessible from the LMS server. Shared hosting environments where Chamilo LMS instances share resources with other applications are also at increased risk, as a compromised Chamilo instance could be used to attack other tenants on the same server.

• linux / server:

journalctl -u chamilo | grep -i "read_url_with_open_graph"

• generic web:

curl -I http://your-chamilo-instance/social_wall/read_url_with_open_graph?social_wall_new_msg_main=http://169.254.169.254/latest/meta-data/ | grep 'HTTP/1.1 302' # Check for redirection to internal metadata endpoint

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-03-10
2. Veröffentlicht2026-04-10
3. EPSS aktualisiert2026-04-18

The primary mitigation for CVE-2026-31941 is to upgrade Chamilo LMS to version 1.11.38 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the Chamilo LMS server to only necessary internal resources. Implement a Web Application Firewall (WAF) with rules to block suspicious outbound requests, particularly those targeting internal IP addresses or cloud metadata endpoints. Carefully review and validate all user-supplied input, especially URLs, to prevent malicious manipulation. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint with a known malicious URL and verifying that the request is blocked or handled securely.