CVE-2025-52998: Chamilo: PHAR deserialization bypass
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52998?
CVE-2025-52998 is rated as medium severity due to the potential for attackers to exploit deserialization vulnerabilities.
How do I fix CVE-2025-52998?
To fix CVE-2025-52998, upgrade to Chamilo version 1.11.30 or later.
What type of vulnerability is CVE-2025-52998?
CVE-2025-52998 is a PHAR deserialization bypass vulnerability.
Who is affected by CVE-2025-52998?
CVE-2025-52998 affects Chamilo LMS versions prior to 1.11.30.
What impact does CVE-2025-52998 have on users?
CVE-2025-52998 allows an attacker to manipulate arbitrary objects, potentially leading to unauthorized actions within the Chamilo LMS.