CVE-2025-52998

HIGH EPSS 28.6%
Published Mar 2, 20264mo ago · Modified Mar 3, 20263mo ago
7.0 CVSS 4.0
High
Find Similar
Published Mar 2, 2026 4mo ago
Last Modified Mar 3, 2026 3mo ago

Description

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

CVSS Details

Base Score
7.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
28.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

VendorProductVersionRange
chamilochamilo_lms* <1.11.30

References 3

  • github.com https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627
    Patch
  • github.com https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
    ProductRelease Notes
  • github.com https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v
    PatchVendor Advisory

Remediation

  • github.com https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627
    Patch
  • github.com https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v
    PatchVendor Advisory