CVE-2026-35196
Published: 14 April 2026
Summary
CVE-2026-35196 is a high-severity OS Command Injection (CWE-78) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-35196 is an OS Command Injection vulnerability (CWE-78) affecting Chamilo LMS, an open-source learning management system, in versions prior to 2.0.0-RC.3. The issue resides in the main/inc/ajax/gradebook.ajax.php endpoint, specifically within the export_all_certificates action. There, the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is directly concatenated into a shell_exec() command string without sanitization or escaping using escapeshellarg(), enabling injection of shell metacharacters. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with low privileges (PR:L) can exploit this by manipulating or poisoning their session data to inject malicious content into the _cid variable. Upon triggering the export_all_certificates action, this leads to arbitrary command execution on the underlying server. Successful exploitation allows the attacker to read system files and credentials, alter the application and database, or disrupt server availability.
The vulnerability has been addressed in Chamilo LMS version 2.0.0-RC.3, as detailed in the project's security advisory (GHSA-crc6-r6c7-44q3), release notes, and the fixing commit. Security practitioners should urge users to upgrade to 2.0.0-RC.3 or later to mitigate the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22722
Vulnerability details
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is…
more
concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-35196 is an OS command injection vulnerability in a public-facing web application (Chamilo LMS), enabling authenticated low-privilege attackers to achieve arbitrary Unix shell command execution via unsanitized session data in shell_exec().
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires input validation mechanisms that would sanitize or validate the session-derived course code before concatenation into shell_exec(), directly preventing OS command injection.
SI-2 mandates timely flaw remediation, including applying the patch in Chamilo LMS 2.0.0-RC.3 that fixes the unsanitized shell_exec() usage.
SI-4 enables system monitoring to detect anomalous command executions or indicators of OS command injection from the gradebook.ajax.php endpoint.