Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-45145— Chamilo LMS: Database-backed PHP object injection in career deserialization

Quick assessment

Affected

chamilo chamilo-lms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Chamilo LMS 是一个开源的学习管理系统。在 2.0.1 版本之前，和文件在从数据库读取字段后，直接调用了 PHP 原生的函数，且未启用这一安全选项。若攻击者能够通过其他途径（例如独立的 SQL 注入漏洞、被篡改的管理员 CSV 导入功能，或权限较低的管理后台）向该字段写入精心构造的序列化 PHP 对象，则可在自动加载的 Symfony、Doctrine 或 Monolog 组件中实例化任意 PHP 对象并触发 POP（Property-Oriented Programming）gadget 链。

CVSS 7.5 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Chamilo LMS: Database-backed PHP object injection in career deserialization

Source: CVE Program / CVE List V5

Vulnerability Description

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
chamilo	chamilo-lms	< 2.0.1	-

II. Public POCs for CVE-2026-45145

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-45145

请登录查看更多情报信息。

Vendor Pages for CVE-2026-45145 (1)

🔗 Release v2.0.1 · chamilo/chamilo-lms · GitHub x_refsource_MISC

Other References for CVE-2026-45145 (2)

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pr59-4rm7-ghwx x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/4da33d8fd317fe5d58041f3202dddc62282ef2fb x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-45145

Same Patch Batch · chamilo · 2026-10-30 · 4 CVEs total

CVE-2026-45144	8.9 HIGH	Chamilo LMS: Stored XSS in public user-profile fields
CVE-2026-44344	6.6 MEDIUM	Chamilo LMS: Conditional PHP execution through vendored QuickForm eval
CVE-2026-45141	6.5 MEDIUM	Chamilo LMS: CSRF in destructive skill-management AJAX actions

IV. Related Vulnerabilities

Same product: chamilo-lms

Same vendor: chamilo

Same weakness: CWE-502