Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-31941: Chamilo LMS lets attacker reach internal network via Social Wall

CVE-2026-31941 · published 6 months ago

Summary

Versions of Chamilo LMS before the latest releases let a logged‑in user supply a web address that the server will fetch without checking where it points. This can be used to poke around internal services, scan ports, or read cloud metadata. Updating to the newest version eliminates the risk.

What to do

Update chamilo chamilo_lms to version 1.11.38 or later.

Affected software

Vendor	Product	Affected versions
chamilo	chamilo_lms	< 1.11.38 2.0.0 `cpe:2.3:a:chamilo:chamilo_lms::::::::`

Original advisory text

Server-Side Request Forgery (SSRF) in Chamilo LMS

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via the social_wall_new_msg_main POST parameter and performs two server-side HTTP requests to that URL without validating whether the target is an internal or external resource. This allows an authenticated attacker to force the server to make arbitrary HTTP requests to internal services, scan internal ports, and access cloud instance metadata. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

References

https://github.com/chamilo/chamilo-lms/commit/e3790c5f0ff3b4dc547c2099fadf5c438c... Patch
https://github.com/chamilo/chamilo-lms/commit/ea6b7b7e90580c9b01dc4bcafe4ad73706... Patch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-q74c-mx8x-489h Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31941... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-31941 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published10 Apr 2026

Updated4 Nov 2026

First seen10 Apr 2026

Sources

CVE-2026-31941 · NVD

CVE-2026-31941 · OSV

GHSA-q74c-mx8x-489h · GHSA

Track software like this

Free during beta