PT-2025-39654 · Chamilo · Chamilo

Published 2025-05-13 · Updated 2026-03-07 · CVE-2025-52998

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. Prior to version 1.11.30, the application performs data deserialization that can be spoofed. An attacker can create objects of arbitrary classes and fully control their properties, potentially modifying the web application's logic. The issue relates to flaws in the deserialization mechanism for PHP Archive (PHAR) files. An attacker can remotely modify the application's logic using specially crafted objects.

Recommendations Update to version 1.11.30 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-11697

CVE-2025-52998

GHSA-6MWG-2MW5-RX5V

Affected Products

Chamilo

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52998.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627 · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11697 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-52998 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52998 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/TheHackerWire/status/2028908212024689026 · Twitter Post
• https://twitter.com/cracbot/status/2029874841927700932 · Twitter Post
• https://twitter.com/cracbot/status/2030237136730120673 · Twitter Post
• https://twitter.com/cracbot/status/2029512382188581073 · Twitter Post