CVE-2026-35196highCWE-78

CVE-2026-35196: high-severity vulnerability in chamilo-lms

Chamilo LMS has OS Command Injection via export_all_certificates action

Published · Updated

Follow this CVE+ Monitor chamilo-lms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 1.8%
from disclosure to weaponsame day
Published on NVDApr 14
1st PoCApr 2
In short

Chamilo LMS allows attackers to run arbitrary commands on the server by injecting shell commands through a manipulated course code in the certificate export feature. This can lead to complete server compromise, including theft of files and credentials.

Technical detail

OS Command Injection in gradebook.ajax.php export_all_certificates action where unsanitized $_SESSION['_cid'] is concatenated into shell_exec() without escapeshellarg(). Attack requires session manipulation to inject shell metacharacters; successful exploitation results in arbitrary command execution with application privileges, enabling data exfiltration, system modification, and denial of service.

Summary generated and translated by AI from the official description.
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
chamilo · chamilo-lms
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — chamilo-lms

In the same product, most dangerous first.

CVE-2025-50196HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameterEPSS 3.1%CVE-2025-50194HIGHChamilo: OS Command Injection in /main/cron/lang/check_parse_lang.phpEPSS 3.0%CVE-2025-50197HIGHChamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameterEPSS 3.0%CVE-2025-50195HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.phpEPSS 3.0%CVE-2025-50193HIGHChamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameterEPSS 3.0%CVE-2026-32892CRITICALOS Command Injection in Chamilo LMS 1.11.36EPSS 1.6%