CVE-2025-50198

4.9 MEDIUM
Published: March 02, 2026 Modified: March 03, 2026
View on NVD

Description

Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/chamilo/chamilo-lms/commit/07f7954f2dd18c4f5a307b2a6fa802d9ce36b827
Source: security-advisories@github.com
Patch
https://github.com/chamilo/chamilo-lms/commit/89c67e6630852cf94d288499e2cd6f6a06f9c6f1
Source: security-advisories@github.com
Patch
https://github.com/chamilo/chamilo-lms/commit/8bd86913a89fec084053e2c2916df19f15d03d95
Source: security-advisories@github.com
Patch
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
Source: security-advisories@github.com
Product Release Notes
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-jgxc-96j5-8rrr
Source: security-advisories@github.com
Exploit Mitigation Vendor Advisory

5 reference(s) from NVD

Quick Stats

CVSS v3 Score
4.9 / 10.0
EPSS (Exploit Probability)
0.1%
20th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-502

Affected Vendors

chamilo

Related CVEs

CVE-2026-4514 6.3
CVE-2026-4513 6.3
CVE-2026-4511 6.3
CVE-2026-4510 4.3
CVE-2026-4373 7.5