CVE-2025-52998: Chamilo: PHAR deserialization bypass

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-02 · updated 2026-06-17
Weakness: CWE-502

Description

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

Affected products

chamilo-lms: before 1.11.30 — fixed in 1.11.30

How to fix

Upgrade to a fixed version: chamilo-lms 1.11.30. Check the vendor advisory for mitigations.

References

https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v

Get alerted when CVE-2025-52998 or the next vulnerability affects your stack