CVE-2025-52998

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. Prior to version 1.11.30, the application performs data deserialization that can be spoofed. An attacker can create objects of arbitrary classes and fully control their properties, potentially modifying the web application's logic. The issue relates to flaws in the deserialization mechanism for PHP Archive (PHAR) files. An attacker can remotely modify the application's logic using specially crafted objects.

Recommendations Update to version 1.11.30 or later.