Chamilo LMS EUVD-2026-113997

Exploitation requires the attacker to first write attacker-controlled serialized PHP data into the user_career.extra_data database column - the advisory names three concrete routes: a separate SQL injection, a compromised/malicious admin CSV import processed by public/main/cron/import_csv.php, or access to a lower-privilege admin panel that can populate user_career records. Additionally, the vulnerable unserialize() path must be reached (career diagram rendering in career.lib.php line 495, or the import_csv.php career-results cron at line 2768), and a usable POP gadget chain must exist in the autoloaded Symfony, Doctrine, or Monolog dependencies. Limiting factors: the flaw cannot be triggered by an unauthenticated single request on its own (PR:L and AC:H), it depends on obtaining a database-write primitive, and only Chamilo LMS 2.0.0 is affected (fixed in 2.0.1).

This is a genuine but conditional Remote Code Execution issue (CWE-502 PHP Object Injection) whose real-world priority is moderate rather than critical, despite the 7.5 'High' CVSS score. The supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) encodes the central caveat: AC:H and PR:L reflect that the flaw is not directly exploitable on its own - the attacker must first obtain the ability to write crafted serialized data into the user_career.extra_data database column. No EPSS score was provided, the CVE is not listed in CISA KEV, and no working proof-of-concept or exploit code is present in the inputs - only the GHSA advisory and the fix commit, which document the vulnerable lines but not an exploitation routine. These signals are consistent with each other: a chaining/second-stage vulnerability with no confirmed exploitation. The vuln.today decision label is 'this_week', which matches a patch-promptly-but-not-emergency posture. Note one tension worth verifying: the description and CVSS use AV:N, but exploitation actually depends on a separate write primitive (SQL injection, malicious admin CSV import, or a lower-privilege admin panel) rather than a single network request, so the effective attack surface is narrower than 'network-reachable RCE' implies.

An attacker who already holds a lower-privilege admin account (or has found a separate SQL injection) writes a crafted serialized PHP object into the user_career.extra_data column. When career.lib.php renders the career diagram or import_csv.php processes career results, the native unserialize() call instantiates the object and triggers a POP gadget chain in the autoloaded Symfony, Doctrine, or Monolog components, yielding OS command execution as the web server user. No public working exploit is present in the inputs, and the AC:H rating reflects that a prerequisite database-write primitive must be obtained first.