A public AJAX endpoint, public/main/inc/ajax/install.ajax.php, was deployed without the global.inc.php include that enforces authentication checks. The test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data, causing the Chamilo server to attempt an outbound SMTP connection to the provided target. This allows an attacker to send emails that appear to originate from the Chamilo host (an open email relay) and to perform SSRF against internal SMTP services, potentially leaking network topology through error responses. The vulnerability directly leads to unauthorized remote SMTP communication and potential internal network reconnaissance.

Chamilo LMS, open‑source learning management system, is affected in version 2.0‑RC.2 and prior builds that contain the vulnerable install.ajax.php file. The fix was introduced in version 2.0.0‑RC.3, which removes the unauthenticated access to the test_mailer action.

The CVSS score of 7.2 indicates a high impact with a well‑exploitable vector. EPSS data is unavailable, so the likelihood of exploitation is unknown; however, the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by issuing an unauthenticated HTTP POST request to the public endpoint and supplying a crafted SMTP DSN. Once invoked, the Chamilo server can relay email and reach internal services, which could facilitate further lateral movement or phishing campaigns.