What is the CVSS score of CVE-2025-52998?

CVE-2025-52998 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chamilo Lms are affected by CVE-2025-52998?

Chamilo learning management systems prior to version 1.11.30 contain a critical vulnerability allowing remote code execution through unsafe deserialization.. A patch is available.

How to fix or mitigate CVE-2025-52998?

Within 24 hours: Identify all Chamilo instances and document current versions; assess internet exposure and isolate affected systems if possible. Within 7 days: Apply vendor patch to version 1.11.30 or later on all Chamilo deployments; validate patch installation and verify system functionality. Within 30 days: Conduct forensic review for unauthorized access or data exfiltration; review access logs from the vulnerability window; implement network segmentation to limit LMS lateral movement.

Chamilo Lms CVE-2025-52998

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-02 security-advisories@github.com

Deserialization Chamilo Lms

9.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 03, 2026 - 18:21 nvd

Patch available

CVE Published

Mar 02, 2026 - 16:16 nvd

CRITICAL 9.8

DescriptionNVD

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

AnalysisAI

Chamilo LMS prior to 1.11.30 has an insecure deserialization vulnerability enabling remote code execution through crafted serialized data.

Technical ContextAI

Chamilo < 1.11.30 has a CWE-502 deserialization vulnerability. Fifth critical Chamilo vulnerability in the advisory batch.

RemediationAI

Update Chamilo to 1.11.30+ which addresses all five vulnerabilities.

CVE-2025-52998 vulnerability details – vuln.today

Back

Chamilo Lms CVE-2025-52998

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code