CVE-2025-50198: Chamilo LMS Deserialization Vulnerability

CVE-2025-50198 Overview

CVE-2025-50198 is an Insecure Deserialization vulnerability affecting Chamilo, a widely-used open-source learning management system (LMS). The vulnerability exists in the VChamilo plugin's import functionality located at /plugin/vchamilo/views/import.php. An attacker can exploit this flaw by manipulating POST parameters including configuration_file, course_path, and home_path to trigger deserialization of untrusted data, potentially leading to remote code execution or system compromise.

Critical Impact

This vulnerability allows unauthenticated attackers to exploit insecure deserialization through crafted POST requests, potentially achieving arbitrary code execution on affected Chamilo LMS installations prior to version 1.11.30.

Affected Products

• Chamilo LMS versions prior to 1.11.30
• VChamilo plugin import functionality (/plugin/vchamilo/views/import.php)
• Chamilo instances with VChamilo plugin enabled

Discovery Timeline

• 2026-03-02 - CVE-2025-50198 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-50198

Vulnerability Analysis

The vulnerability resides in the VChamilo plugin's import.php file, which handles the import of virtual Chamilo instances. The affected code processes user-supplied paths through POST parameters without adequate validation, specifically failing to sanitize paths that could point to phar:// stream wrappers.

PHP's phar:// stream wrapper can be exploited to trigger deserialization of metadata within PHAR (PHP Archive) files. When an attacker supplies a malicious phar:// path through the configuration_file, course_path, home_path, or upload_path parameters, the application may deserialize attacker-controlled data embedded in the PHAR archive. This deserialization can lead to arbitrary object instantiation and, through gadget chain exploitation, potentially result in remote code execution.

The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The attack can be conducted remotely over the network, requires no user interaction, and does not require authentication to exploit.

Root Cause

The root cause is insufficient input validation on file path parameters passed to the VChamilo import functionality. The original code directly used user-supplied paths in file system operations without checking for malicious stream wrapper prefixes. Specifically, the code failed to validate that the configuration_file, course_path, home_path, and upload_path parameters do not contain phar:// prefixes, which can trigger PHP object deserialization when processed by file functions.

Attack Vector

An attacker exploits this vulnerability by sending a crafted HTTP POST request to /plugin/vchamilo/views/import.php. The malicious request includes a phar:// URI pointing to an attacker-controlled PHAR file containing a malicious serialized object. When the application processes these paths using PHP file functions like file_exists() or is_readable(), the phar:// stream wrapper is triggered, causing PHP to deserialize the metadata section of the PHAR file. If suitable PHP gadget chains exist in the application's codebase, this deserialization can lead to arbitrary code execution.

The attack requires:

1. A malicious PHAR file uploaded or accessible to the target server
2. A POST request containing phar:// paths referencing this file
3. Presence of exploitable PHP classes (gadget chains) in the application

// Security patch from plugin/vchamilo/views/import.php
// Source: https://github.com/chamilo/chamilo-lms/commit/07f7954f2dd18c4f5a307b2a6fa802d9ce36b827

     $coursePath = $values['course_path'];
     $homePath = $values['home_path'];
     $confFile = $values['configuration_file'];
+    $uploadPath = $values['upload_path'];
 
-    if (is_dir($coursePath) &&
-        is_dir($homePath) &&
-        file_exists($confFile) &&
-        is_readable($confFile)
-    ) {
+    $isPharFile = str_starts_with($confFile, 'phar://')
+        || str_starts_with($coursePath, 'phar://')
+        || str_starts_with($homePath, 'phar://')
+        || str_starts_with($uploadPath, 'phar://');
+
+    $isWritable = is_dir($coursePath)
+        && is_dir($homePath)
+        && is_dir($uploadPath)
+        && file_exists($confFile)
+        && is_readable($confFile);
+
+    if (!$isPharFile && $isWritable) {
         $currentHost = api_get_configuration_value('db_host');
         $currentDatabase = api_get_configuration_value('main_database');
         $currentUser = api_get_configuration_value('db_user');

Detection Methods for CVE-2025-50198

Indicators of Compromise

• HTTP POST requests to /plugin/vchamilo/views/import.php containing phar:// in parameter values
• Web server logs showing unusual requests to the VChamilo import endpoint with encoded or suspicious path values
• Presence of unexpected PHAR files in web-accessible directories or temporary folders
• Suspicious process spawns originating from PHP/web server processes following requests to the import endpoint

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing phar:// stream wrapper references in POST parameters
• Configure intrusion detection systems (IDS) to alert on HTTP POST requests to /plugin/vchamilo/views/import.php with unusual payloads
• Monitor application logs for access attempts to the VChamilo plugin import functionality, especially from external IP addresses
• Deploy file integrity monitoring on Chamilo installation directories to detect unauthorized file modifications

Monitoring Recommendations

• Enable detailed logging for all requests to Chamilo plugin endpoints and review logs for anomalous patterns
• Monitor for PHP deserialization-related errors in application and PHP error logs
• Implement network-level monitoring for outbound connections from web servers that may indicate successful exploitation
• Track changes to Chamilo configuration files and database entries that could indicate post-exploitation activity

How to Mitigate CVE-2025-50198

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.30 or later immediately, which contains the security fix for this vulnerability
• If immediate upgrade is not possible, disable the VChamilo plugin until patching can be completed
• Review web server access logs for any suspicious requests to /plugin/vchamilo/views/import.php that may indicate exploitation attempts
• Implement WAF rules to block requests containing phar:// in POST parameters to the affected endpoint

Patch Information

Chamilo has released version 1.11.30 which addresses this vulnerability. The fix implements validation to detect and reject phar:// stream wrapper prefixes in the configuration_file, course_path, home_path, and upload_path parameters before processing them. The patch is available through the official Chamilo GitHub Release v1.11.30.

Additional security fixes related to this vulnerability can be found in the following commits:

• Security patch for phar:// path handling
• MIME type validation improvements
• File upload error handling refactor

For complete details, refer to the GitHub Security Advisory GHSA-jgxc-96j5-8rrr.

Workarounds

• Disable the VChamilo plugin entirely if it is not actively required for operations by removing or renaming the /plugin/vchamilo/ directory
• Implement strict access controls to restrict access to the VChamilo import functionality to trusted administrator IP addresses only
• Deploy a web application firewall rule to block all POST requests containing phar:// string patterns to the Chamilo application
• Consider implementing PHP's phar.readonly = 1 configuration directive to prevent phar:// deserialization attacks at the PHP level

# Configuration example - Apache .htaccess to block access to VChamilo import
# Place in Chamilo root or plugin directory

<FilesMatch "import\.php$">
    <If "%{REQUEST_URI} =~ m#/plugin/vchamilo/views/import\.php#">
        Require ip 10.0.0.0/8 192.168.0.0/16
    </If>
</FilesMatch>

# PHP configuration to mitigate phar deserialization
# Add to php.ini or .user.ini
# phar.readonly = 1