CVE-2026-45145 Details
Description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.
A remote code execution vulnerability exists in Chamilo LMS versions prior to 2.0.1. The issue arises in 'public/main/inc/lib/career.lib.php' and 'public/main/cron/import_csv.php', where the native 'unserialize()' function is used on 'user_career.extra_data' from the database without the 'allowed_classes: false' option. This flaw allows an attacker to inject crafted serialized PHP objects into the 'extra_data' column, potentially through SQL injection, a compromised admin CSV import, or a lower-privilege admin panel. Exploiting this vulnerability could lead to the execution of arbitrary OS commands as the web server user, thereby compromising the server's confidentiality, integrity, and availability.
Users can upgrade to Chamilo LMS version 2.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chamilo/chamilo-lms/commit/4da33d8fd317fe5d58041f3202dddc62282ef2fb | [email protected] | Source CodeVendor |
| https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1 | [email protected] | Release NotesVendor |
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pr59-4rm7-ghwx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chamilo LMS | 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |