What is the CVSS score of CVE-2025-52998?

CVE-2025-52998 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chamilo Lms are affected by CVE-2025-52998?

Chamilo learning management systems prior to version 1.11.30 contain a critical vulnerability allowing remote code execution through unsafe deserialization.. A patch is available.

How to fix or mitigate CVE-2025-52998?

Within 24 hours: Identify all Chamilo instances and document current versions; assess internet exposure and isolate affected systems if possible. Within 7 days: Apply vendor patch to version 1.11.30 or later on all Chamilo deployments; validate patch installation and verify system functionality. Within 30 days: Conduct forensic review for unauthorized access or data exfiltration; review access logs from the vulnerability window; implement network segmentation to limit LMS lateral movement.

Chamilo Lms CVE-2025-52998

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-02 security-advisories@github.com

Deserialization Chamilo Lms

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 03, 2026 - 18:21 nvd

Patch available

CVE Published

Mar 02, 2026 - 16:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.