An unauthenticated SSRF flaw exists in the PENS plugin of Chamilo LMS. The public endpoint at public/plugin/Pens/pens.php accepts a user‑controlled package‑url parameter that the server fetches with curl without filtering private or internal IP addresses. An attacker can supply arbitrary URLs to force the server to fetch internal resources, including cloud metadata endpoints such as 169.254.169.254, thereby exposing IAM credentials and other sensitive data. The vulnerability also permits state‑changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to trigger either SQLS vector, greatly expanding the attack surface.

Chamilo Learning Management System for all versions before 2.0.0‑RC.3, specifically the PENS plugin exposed through public/plugin/Pens/pens.php. The affected vendor is Chamilo and the product is Chamilo LMS.

The CVSS score of 8.6 indicates high severity, and the lack of an EPSS value implies that the exploitation probability is not quantified but the vulnerability is potentially active due to its public access. The flaw is not listed in the CISA KEV catalog. Because the endpoint is reachable without authentication, an attacker from the public internet can directly craft a request to the package‑url parameter and direct the server to internal network addresses, enabling reconnaissance or credential theft. Remote SSRF translates into a broad attack vector that can be used to compromise internal hosts, leak secrets, and perform unwanted operations on internal services.