Deserialization Vulnerability in Chamilo LMS Affects Multiple Components

CVE-2026-45145

What is CVE-2026-45145?

Chamilo LMS, an open-source learning management system, is vulnerable to a deserialization attack due to improper handling of PHP's native unserialize() function. Prior to version 2.0.1, sensitive user data from the database could be misused when an attacker crafts serialized PHP objects. This vulnerability could be exploited through methods such as SQL injection or a compromised CSV import by admin users, allowing for the instantiation of arbitrary PHP objects and enabling potential command execution on the server. Mitigation is available in the latest release.

References