by Kastro
Paper/Archive/CVE-2025-52998

CVE-2025-52998

chamilo chamilo-lms — Chamilo: PHAR deserialization bypass

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.9.379 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

Affected

ProductAffectedFixed inSource
chamilo-lms< 1.11.30–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5vrefgithub.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627refgithub.com/chamilo/chamilo-lms/releases/tag/v1.11.30