CVE-2025-52998 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers create arbitrary objects and modify application logic, exploit requires crafted data input.

Severity & Score

Impact

Attackers can modify application logic, potentially leading to remote code execution or privilege escalation.

Mitigation

Update to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 3, 2026

🔴 CVE-2025-52998 - Critical (9.8) Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, a... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52998/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner