CVE-2025-50198: 
Chamilo vulnerability analysis and mitigation

CVE-2025-50198 is a deserialization of untrusted data vulnerability in Chamilo LMS affecting the VChamilo plugin's import functionality. The flaw exists in /plugin/vchamilo/views/import.php, where POST parameters (configuration_file, course_path, home_path) are processed without adequate validation, enabling PHP object injection via phar:// stream wrappers. All Chamilo LMS versions up to and including 1.11.28 are affected; the issue was disclosed on March 2, 2026, and patched in version 1.11.30. It carries a CVSS v3.1 score of 4.9 (Medium) and a CVSS v4.0 score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-502 (Deserialization of Untrusted Data) in the VChamilo plugin's import view (/plugin/vchamilo/views/import.php). The vulnerable code accepted user-supplied paths via POST parameters and passed them to PHP filesystem functions (is_dir(), file_exists(), is_readable()) without first checking for phar:// stream wrapper prefixes — a classic PHP deserialization gadget vector. By supplying a crafted phar:// path pointing to an attacker-controlled PHAR archive, an adversary can trigger PHP object deserialization during the filesystem stat call, potentially instantiating arbitrary PHP objects and manipulating application logic. The fix adds explicit phar:// prefix detection before any filesystem operations are performed (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to perform PHP object injection, enabling arbitrary class instantiation and full control over object properties, which can modify application logic and potentially lead to remote code execution depending on available gadget chains in the application's codebase. The CVSS v4.0 assessment indicates high availability impact and low confidentiality and integrity impact on the vulnerable system. In environments with exploitable gadget chains, the impact could extend to full server compromise, data exfiltration, and lateral movement within the hosting infrastructure (GitHub Advisory).

The GitHub Security Advisory lists the exploitation condition as requiring an authenticated user with the administrator role, which aligns with the CVSS v3.1 score of 4.9 (High Privileges Required); however, the CVSS v4.0 vector rates Privileges Required as None, reflecting a broader threat model (GitHub Advisory). No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.044%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE).

1. Reconnaissance: Identify Chamilo LMS instances running versions ≤1.11.28 using web fingerprinting tools (e.g., Shodan, Censys) or by checking the Chamilo version page.
2. Obtain administrator credentials: Gain access to an administrator account through credential theft, phishing, brute force, or by exploiting a separate authentication bypass vulnerability.
3. Craft a malicious PHAR archive: Create a PHP PHAR file containing a serialized PHP object that leverages an available gadget chain within Chamilo's codebase to achieve code execution upon deserialization.
4. Upload the PHAR archive: Upload the crafted PHAR file to the server using any file upload functionality accessible to the administrator (e.g., course file uploads).
5. Trigger deserialization: Send a POST request to /plugin/vchamilo/views/import.php with one of the parameters (configuration_file, course_path, or home_path) set to a phar:// path pointing to the uploaded PHAR archive (e.g., phar:///path/to/uploaded/file.jpg).
6. Achieve code execution: PHP's filesystem functions (file_exists(), is_dir(), is_readable()) trigger PHAR deserialization, instantiating the attacker's crafted object and executing the embedded payload (GitHub Advisory, GitHub Commit).

• Network: Unusual POST requests to /plugin/vchamilo/views/import.php containing phar:// strings in configuration_file, course_path, or home_path parameters; unexpected outbound connections from the web server process.
• Logs: Web server access logs showing POST requests to /plugin/vchamilo/views/import.php with parameter values beginning with phar://; PHP error logs showing deserialization-related exceptions or unexpected object instantiation.
• File System: Newly created or modified PHP files in web-accessible directories (potential web shells); PHAR archives uploaded with non-PHAR extensions (e.g., .jpg, .png) in course or user upload directories.
• Process: Unexpected child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python); unusual network connections initiated by the web server user account.

Upgrade Chamilo LMS to version 1.11.30 or later, which includes the fix that explicitly checks for phar:// stream wrapper prefixes in all POST parameters before performing any filesystem operations (Chamilo Release, GitHub Commit). For environments unable to patch immediately, restrict network access to the /plugin/vchamilo/views/import.php endpoint via web server configuration (e.g., IP allowlisting), and monitor for suspicious POST requests to this path. Additionally, consider disabling the VChamilo plugin entirely if it is not in active use, and ensure PHP's phar.readonly INI directive is set to On to prevent PHAR archive creation.

The vulnerability was discovered and reported by Aleksey Solovev of Positive Technologies, as credited in the GitHub Security Advisory (GitHub Advisory). The Chamilo project published the advisory and released the patch on March 2, 2026. No significant broader media coverage or notable community discussion beyond standard vulnerability tracking platforms has been observed.