PT-2025-37377 · Chamilo · Chamilo

Published 2025-04-01 · Updated 2026-03-02 · CVE-2025-50198

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system susceptible to deserialization of untrusted data. The issue resides in /plugin/vchamilo/views/import.php and is triggered through POST requests utilizing the configuration file, course path, and home path parameters. Successful exploitation could allow a remote attacker to create objects of arbitrary classes.

Recommendations Update to version 1.11.30 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-06911

CVE-2025-50198

GHSA-JGXC-96J5-8RRR

Affected Products

Chamilo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50198.json · Exploit
• 🔥 https://github.com/chamilo/chamilo-lms/wiki/security-issues#issue-193---2025-04-17---moderate-impact-low-risk---deserialization-of-untrusted-data-cve-2025-50198 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/07f7954f2dd18c4f5a307b2a6fa802d9ce36b827 · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-jgxc-96j5-8rrr · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/8bd86913a89fec084053e2c2916df19f15d03d95 · Patch
• https://github.com/chamilo/chamilo-lms/commit/89c67e6630852cf94d288499e2cd6f6a06f9c6f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-50198 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50198 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06911 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note