Deserialization of Untrusted Data in Chamilo LMS - CVE-2026-61622
Published: August 4, 2026
Vulnerability identifier: #VU140912
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-61622
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in Sequence::getUnSerializeGraph() when processing database-stored sequence graph data. A remote attacker can write a crafted PHP gadget chain into the sequence.graph column to execute arbitrary code.
Exploitation requires the ability to write to the sequence.graph column, and code execution is triggered when an authenticated user visits a sequence page.
Affected software
Chamilo LMS
How to mitigate CVE-2026-61622
Install security update from vendor's website.
Chamilo LMS - update to 2.0.3