# CVE-2026-45145: Chamilo LMS unsafe deserialization in career data

Source: https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-45145 · Severity: high · CVSS 7.5 · Published 2026-10-30

Chamilo LMS, a learning management system used by educational institutions to deliver courses online, contains a critical flaw in how it processes saved career data from the database. An attacker who can inject malicious serialized objects into the database—through SQL injection, a compromised admin import, or lower-level admin privileges—can execute arbitrary commands on the server with the privileges of the web server user, potentially compromising the entire system and its user data.

Technologies: [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms). Vendors: [Chamilo](https://junglewise.ai/threats/vendors/chamilo).

## Quick answers

**Is CVE-2026-45145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45145 being exploited in the wild.

**How severe is CVE-2026-45145?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** Chamilo Lms prior to 2.0.1.

**Is there a fix for CVE-2026-45145?** Yes: fixed in 2.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45145 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45145?** Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.1

## Technical details

The vulnerability stems from unsafe use of PHP's unserialize() function on user_career.extra_data column without the allowed_classes: false safety option in career.lib.php and import_csv.php. An attacker with database write access can craft serialized PHP objects that trigger POP (Property-Oriented Programming) gadget chains in autoloaded Symfony, Doctrine, or Monolog components to achieve remote code execution as the web server user.

## Affected products

- Chamilo Chamilo LMS prior to 2.0.1

## Timeline

- 2026-10-30: disclosed
- 2026-05-08: patched: v2.0.1 released

## References

- [https://github.com/chamilo/chamilo-lms/commit/4da33d8fd317fe5d58041f3202dddc62282ef2fb](https://github.com/chamilo/chamilo-lms/commit/4da33d8fd317fe5d58041f3202dddc62282ef2fb)
- [https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1](https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1)

## Related threats

- [Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0)
- [Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS arbitrary code execution in HTML_QuickForm](https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1)
- [Chamilo LMS missing authorization in legacy AJAX handlers](https://junglewise.ai/threats/cve-2026-114390-chamilo-lms-from-2-0-0-alpha-1-before-2-0-0-rc-3-contains-a)