Chamilo LMS has a PHP object injection vulnerability arising from the use of PHP's unserialize function on data retrieved from the database without setting allowed_classes to false. An attacker that can inject crafted serialized objects into the user_career.extra_data field, for example via SQL injection, a compromised CSV import, or a lower‑privilege admin panel, can trigger gadget chains in autoloaded Symfony, Doctrine, or Monolog components, allowing execution of arbitrary OS commands as the web server user. This results in full compromise of the server, affecting confidentiality, integrity, and availability.

Chamilo LMS, version 2.0.0 and earlier, across all installations that use the public/main/inc/lib/career.lib.php or public/main/cron/import_csv.php modules and store user career data in the database. The vulnerability was fixed in the 2.0.1 release.

The CVSS score of 7.5 indicates high risk, and the lack of an EPSS score means exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker must first gain the capability to write serialized payloads into the database, which may require exploiting an existing SQL injection or compromising the CSV import process. Once that prerequisite is met, the gadget chain can be invoked to run arbitrary commands with the privileges of the web server.