CVE-2026-45145 Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

CVE-2026-45145

The open-source learning management system Chamilo LMS is vulnerable to a database-backed PHP object injection in its career deserialization process. Specifically, the files public/main/inc/lib/career.lib.php and public/main/cron/import_csv.php call PHP's native unserialize() on the user_career.e...

CVE-2026-45145 Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

EUVD-2026-113997

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...