CVE-2026-45145 Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...