# CVE-2026-33715: Chamilo LMS SSRF and open email relay in install.ajax.php

Source: https://junglewise.ai/threats/cve-2026-33715-chamilo-lms-ssrf-and-open-email-relay-in-install-ajax-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33715 · Severity: high · CVSS 7.2 · Published 2026-04-14

Chamilo LMS, a popular open-source learning management system, contains a security flaw that allows unauthorized individuals to use the server as a tool for sending spam or phishing emails. By exploiting an unprotected installation script, attackers can make emails appear as if they are coming from the organization's official server, damaging its reputation. Additionally, attackers can use this flaw to probe the organization's internal network, potentially discovering other private systems and services.

Technologies: [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms). Vendors: [Chamilo](https://junglewise.ai/threats/vendors/chamilo).

## Quick answers

**Is CVE-2026-33715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33715 being exploited in the wild.

**How severe is CVE-2026-33715?** High severity, with a CVSS score of 7.2, published 14 April 2026.

**Which products and versions are affected?** Chamilo Chamilo LMS 2.0-RC.2.

**Is there a fix for CVE-2026-33715?** A patch was published on 2026-04-14: Fixed in version 2.0.0-RC.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33715 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33715?** Check whether you run Chamilo Lms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass exists in Chamilo LMS 2.0-RC.2 because the 'install.ajax.php' endpoint fails to include 'global.inc.php', which normally enforces authentication and installation-status checks. An unauthenticated remote attacker can invoke the 'test_mailer' action and provide an arbitrary Symfony Mailer DSN string via POST data. This allows the attacker to force the server to connect to any SMTP server (SSRF) or use the server as an open relay to send unauthorized emails. This can lead to internal network reconnaissance via SMTP error messages or the weaponization of the server for phishing campaigns. The issue is resolved in version 2.0.0-RC.3.

## Affected products

- Chamilo Chamilo LMS 2.0-RC.2

## Timeline

- 2026-04-14: advisory: Vendor advisory published via GitHub
- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 2.0.0-RC.3

## References

- [https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3](https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3)
- [https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mxc9-9335-45mc](https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mxc9-9335-45mc)

## Related threats

- [Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS unsafe deserialization in career data](https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0)
- [Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS arbitrary code execution in HTML_QuickForm](https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1)