## Summary
Chamilo LMS contains a post-authentication phar deserialization issue that can lead to remote code execution (RCE) on the server. The vulnerability affects versions 1.11.12 through 1.11.26 and has been patched in 1.11.26 (with a subsequent security fix release noted as 1.11.28).
## Technical Details
- Root cause (as described in the advisory content): a post-authentication phar unserialize that results in RCE.
- Exploitation approach (as described): an administrator can abuse multiple supported features from the virtualization plugin vchamilo to execute arbitrary code on the server.
- Attack prerequisites (from CVSS vector and advisory context): requires authenticated access with administrative privileges (PR:H, UI:N).
- Affected component context: virtualization plugin vchamilo is explicitly mentioned as part of the abuse chain.
## Affected
- chamilo-lms / Chamilo LMS versions 1.11.12 to 1.11.26 (inclusive per NVD text; advisory content states the range 1.11.12 up to 1.11.26).
## Impact
- Remote code execution (RCE) on the server.
- High impact on confidentiality, integrity, and availability (CVSS C:H/I:H/A:H).
- Scope is unchanged (S:U) and the attack is network-reachable (AV:N).
## Mitigation
1. Upgrade Chamilo to a fixed version; the advisory content states the issue is patched in 1.11.26 and references a security fix release at v1.11.28.
2. Restrict administrative access paths and ensure only trusted admins can use virtualization-related features/plugins such as vchamilo.
3. Monitor for suspicious admin actions related to virtualization/plugin workflows, since exploitation is post-authentication and admin-driven.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-502