CVE-2025-52998 Chamilo: PHAR deserialization bypass
Attackers can exploit PHAR deserialization in Chamilo LMS to create arbitrary objects and modify application logic, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-52998?
CVE-2025-52998 is a high-severity unsafe deserialization vulnerability in Chamilo Chamilo Lms, published on 2 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.
Weakness: CWE-502
Which versions are affected by CVE-2025-52998?
It affects 1 product.
Products include Chamilo Chamilo Lms.
How do I fix CVE-2025-52998?
No fix has been published for CVE-2025-52998 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-52998 being exploited?
There is no known exploitation of CVE-2025-52998 in the wild and no public exploit code.
Other vulnerabilities in Chamilo Chamilo Lms
Sources
Also known as GHSA-6mwg-2mw5-rx5v.