Vulnerability Description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/chamilo/chamilo-lms/commit/4da33d8fd317fe5d58041f3202dddc6228
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pr59-4rm7-ghwx
FAQ
What is CVE-2026-45145?
CVE-2026-45145 is a vulnerability with a CVSS score of 7.5 (HIGH). Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.e...
How severe is CVE-2026-45145?
CVE-2026-45145 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45145?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.