CVE-2026-35196
OS Command Injection in Chamilo LMS Allows Remote Code Execution
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | 2.0.0 |
| chamilo | chamilo_lms | to 1.11.38 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access to sensitive data, alteration of application and database contents, and disruption of server availability.
Such unauthorized access and data manipulation could result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information, maintaining data integrity, and ensuring system availability.
Can you explain this vulnerability to me?
This vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3. It is an OS Command Injection flaw found in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action.
The issue arises because the course code, retrieved from the session variable $_SESSION['_cid'] via the api_get_course_id() function, is directly concatenated into a shell_exec() command string without proper sanitization or escaping.
If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can execute arbitrary commands on the underlying server.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the server hosting Chamilo LMS.
- Read sensitive system files and credentials.
- Alter the application and its database.
- Disrupt server availability, potentially causing denial of service.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where the issue has been fixed.
Avoid using vulnerable versions prior to 2.0.0-RC.3, as they allow OS command injection via unsanitized session variables.