CVE-2025-50198: Chamilo LMS Deserialization Vulnerability

CVE-2025-50198 Overview

CVE-2025-50198 is an Insecure Deserialization vulnerability affecting Chamilo, a widely-used open-source learning management system (LMS). The vulnerability exists in the VChamilo plugin's import functionality located at /plugin/vchamilo/views/import.php. An attacker can exploit this flaw by manipulating POST parameters including configuration_file, course_path, and home_path to trigger deserialization of untrusted data, potentially leading to remote code execution or system compromise.

Critical Impact
This vulnerability allows unauthenticated attackers to exploit insecure deserialization through crafted POST requests, potentially achieving arbitrary code execution on affected Chamilo LMS installations prior to version 1.11.30.

Affected Products

Chamilo LMS versions prior to 1.11.30
VChamilo plugin import functionality (/plugin/vchamilo/views/import.php)
Chamilo instances with VChamilo plugin enabled

Discovery Timeline

2026-03-02 - CVE-2025-50198 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-50198

Vulnerability Analysis

The vulnerability resides in the VChamilo plugin's import.php file, which handles the import of virtual Chamilo instances. The affected code processes user-supplied paths through POST parameters without adequate validation, specifically failing to sanitize paths that could point to phar:// stream wrappers.

PHP's phar:// stream wrapper can be exploited to trigger deserialization of metadata within PHAR (PHP Archive) files. When an attacker supplies a malicious phar:// path through the configuration_file, course_path, home_path, or upload_path parameters, the application may deserialize attacker-controlled data embedded in the PHAR archive. This deserialization can lead to arbitrary object instantiation and, through gadget chain exploitation, potentially result in remote code execution.

The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The attack can be conducted remotely over the network, requires no user interaction, and does not require authentication to exploit.

Root Cause

The root cause is insufficient input validation on file path parameters passed to the VChamilo import functionality. The original code directly used user-supplied paths in file system operations without checking for malicious stream wrapper prefixes. Specifically, the code failed to validate that the configuration_file, course_path, home_path, and upload_path parameters do not contain phar:// prefixes, which can trigger PHP object deserialization when processed by file functions.

Attack Vector

An attacker exploits this vulnerability by sending a crafted HTTP POST request to /plugin/vchamilo/views/import.php. The malicious request includes a phar:// URI pointing to an attacker-controlled PHAR file containing a malicious serialized object. When the application processes these paths using PHP file functions like file_exists() or is_readable(), the phar:// stream wrapper is triggered, causing PHP to deserialize the metadata section of the PHAR file. If suitable PHP gadget chains exist in the application's codebase, this deserialization can lead to arbitrary code execution.

The attack requires:

A malicious PHAR file uploaded or accessible to the target server
A POST request containing phar:// paths referencing this file
Presence of exploitable PHP classes (gadget chains) in the application

php

// Security patch from plugin/vchamilo/views/import.php
// Source: https://github.com/chamilo/chamilo-lms/commit/07f7954f2dd18c4f5a307b2a6fa802d9ce36b827

     $coursePath = $values['course_path'];
     $homePath = $values['home_path'];
     $confFile = $values['configuration_file'];
+    $uploadPath = $values['upload_path'];
 
-    if (is_dir($coursePath) &&
-        is_dir($homePath) &&
-        file_exists($confFile) &&
-        is_readable($confFile)
-    ) {
+    $isPharFile = str_starts_with($confFile, 'phar://')
+        || str_starts_with($coursePath, 'phar://')
+        || str_starts_with($homePath, 'phar://')
+        || str_starts_with($uploadPath, 'phar://');
+
+    $isWritable = is_dir($coursePath)
+        && is_dir($homePath)
+        && is_dir($uploadPath)
+        && file_exists($confFile)
+        && is_readable($confFile);
+
+    if (!$isPharFile && $isWritable) {
         $currentHost = api_get_configuration_value('db_host');
         $currentDatabase = api_get_configuration_value('main_database');
         $currentUser = api_get_configuration_value('db_user');

Detection Methods for CVE-2025-50198

Indicators of Compromise

HTTP POST requests to /plugin/vchamilo/views/import.php containing phar:// in parameter values
Web server logs showing unusual requests to the VChamilo import endpoint with encoded or suspicious path values
Presence of unexpected PHAR files in web-accessible directories or temporary folders
Suspicious process spawns originating from PHP/web server processes following requests to the import endpoint

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests containing phar:// stream wrapper references in POST parameters
Configure intrusion detection systems (IDS) to alert on HTTP POST requests to /plugin/vchamilo/views/import.php with unusual payloads
Monitor application logs for access attempts to the VChamilo plugin import functionality, especially from external IP addresses
Deploy file integrity monitoring on Chamilo installation directories to detect unauthorized file modifications

Monitoring Recommendations

Enable detailed logging for all requests to Chamilo plugin endpoints and review logs for anomalous patterns
Monitor for PHP deserialization-related errors in application and PHP error logs
Implement network-level monitoring for outbound connections from web servers that may indicate successful exploitation
Track changes to Chamilo configuration files and database entries that could indicate post-exploitation activity

How to Mitigate CVE-2025-50198

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.30 or later immediately, which contains the security fix for this vulnerability
If immediate upgrade is not possible, disable the VChamilo plugin until patching can be completed
Review web server access logs for any suspicious requests to /plugin/vchamilo/views/import.php that may indicate exploitation attempts
Implement WAF rules to block requests containing phar:// in POST parameters to the affected endpoint

Patch Information

Chamilo has released version 1.11.30 which addresses this vulnerability. The fix implements validation to detect and reject phar:// stream wrapper prefixes in the configuration_file, course_path, home_path, and upload_path parameters before processing them. The patch is available through the official Chamilo GitHub Release v1.11.30.

Additional security fixes related to this vulnerability can be found in the following commits:

For complete details, refer to the GitHub Security Advisory GHSA-jgxc-96j5-8rrr.

Workarounds

Disable the VChamilo plugin entirely if it is not actively required for operations by removing or renaming the /plugin/vchamilo/ directory
Implement strict access controls to restrict access to the VChamilo import functionality to trusted administrator IP addresses only
Deploy a web application firewall rule to block all POST requests containing phar:// string patterns to the Chamilo application
Consider implementing PHP's phar.readonly = 1 configuration directive to prevent phar:// deserialization attacks at the PHP level

bash

# Configuration example - Apache .htaccess to block access to VChamilo import
# Place in Chamilo root or plugin directory

<FilesMatch "import\.php$">
    <If "%{REQUEST_URI} =~ m#/plugin/vchamilo/views/import\.php#">
        Require ip 10.0.0.0/8 192.168.0.0/16
    </If>
</FilesMatch>

# PHP configuration to mitigate phar deserialization
# Add to php.ini or .user.ini
# phar.readonly = 1