Chamilo LMS exposes a Server-Side Request Forgery in the Social Wall feature, where the read_url_with_open_graph endpoint accepts a URL from users and makes two server-side HTTP requests without validating the target. An attacker who is authenticated can supply any URL, forcing the server to reach internal services, scan ports, or retrieve cloud metadata. This vulnerability enables the disclosure of sensitive data and can serve as a foothold for further internal attacks.

The flaw exists in Chamilo LMS versions earlier than 1.11.38 on the 1.x branch and earlier than 2.0.0-RC.3 on the 2.x branch. Administrators should verify the installed version and upgrade if it falls into these ranges.

The CVSS base score of 7.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because it requires authentication and an internet-reachable endpoint, successful exploitation will depend on obtaining user credentials, after which the attacker can force outbound requests to any host. This could lead to data exfiltration, internal reconnaissance, or further lateral movement.