Is CVE-2026-33715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33715 being exploited in the wild.

How severe is CVE-2026-33715?

High severity, with a CVSS score of 7.2, published 14 April 2026.

Is there a fix for CVE-2026-33715?

A patch was published on 2026-04-14: Fixed in version 2.0.0-RC.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33715 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33715?

Check whether you run Chamilo Lms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33715: Chamilo LMS SSRF and open email relay in install.ajax.php

CVE-2026-33715 · Severity: high · CVSS 7.2 · Published 2026-04-14

Chamilo LMS, a popular open-source learning management system, contains a security flaw that allows unauthorized individuals to use the server as a tool for sending spam or phishing emails. By exploiting an unprotected installation script, attackers can make emails appear as if they are coming from the organization's official server, damaging its reputation. Additionally, attackers can use this flaw to probe the organization's internal network, potentially discovering other private systems and services.

Technologies: Chamilo Lms. Vendors: Chamilo.

Quick answers

Is CVE-2026-33715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33715 being exploited in the wild.
How severe is CVE-2026-33715?: High severity, with a CVSS score of 7.2, published 14 April 2026.
Which products and versions are affected?: Chamilo Chamilo LMS 2.0-RC.2.
Is there a fix for CVE-2026-33715?: A patch was published on 2026-04-14: Fixed in version 2.0.0-RC.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33715 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33715?: Check whether you run Chamilo Lms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in Chamilo LMS 2.0-RC.2 because the 'install.ajax.php' endpoint fails to include 'global.inc.php', which normally enforces authentication and installation-status checks. An unauthenticated remote attacker can invoke the 'test_mailer' action and provide an arbitrary Symfony Mailer DSN string via POST data. This allows the attacker to force the server to connect to any SMTP server (SSRF) or use the server as an open relay to send unauthorized emails. This can lead to internal network reconnaissance via SMTP error messages or the weaponization of the server for phishing campaigns. The issue is resolved in version 2.0.0-RC.3.

Affected products

Chamilo Chamilo LMS 2.0-RC.2

Timeline

2026-04-14: advisory: Vendor advisory published via GitHub
2026-04-14: disclosed
2026-04-14: patched: Fixed in version 2.0.0-RC.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.