CVE-2026-35196 Chamilo LMS has OS Command Injection via export_all_certificates action
Attackers can execute arbitrary OS commands via session poisoning in Chamilo LMS, leading to full server compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35196?
CVE-2026-35196 is a high-severity command injection vulnerability in Chamilo Chamilo Lms, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.
Weakness: CWE-78
Which versions are affected by CVE-2026-35196?
It affects 1 product.
Products include Chamilo Chamilo Lms.
How do I fix CVE-2026-35196?
No fix has been published for CVE-2026-35196 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-35196 being exploited?
There is no known exploitation of CVE-2026-35196 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Chamilo Chamilo Lms
Sources
Also known as GHSA-crc6-r6c7-44q3.