CVE-2026-35196 (GCVE-0-2026-35196)

Vulnerability from cvelistv5 – Published: 2026-04-14 21:33 – Updated: 2026-04-15 14:27
VLAI
Title
Chamilo LMS has OS Command Injection via export_all_certificates action
Summary
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
chamilo chamilo-lms Affected: < 2.0.0-RC.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T14:27:21.595475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T14:27:29.401Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "chamilo-lms",
          "vendor": "chamilo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0-RC.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION[\u0027_cid\u0027] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-14T21:33:13.518Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3"
        }
      ],
      "source": {
        "advisory": "GHSA-crc6-r6c7-44q3",
        "discovery": "UNKNOWN"
      },
      "title": "Chamilo LMS has OS Command Injection via export_all_certificates action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35196",
    "datePublished": "2026-04-14T21:33:13.518Z",
    "dateReserved": "2026-04-01T18:48:58.937Z",
    "dateUpdated": "2026-04-15T14:27:29.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-35196",
      "date": "2026-07-31",
      "epss": "0.0176",
      "percentile": "0.75761"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-35196\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-14T22:16:31.993\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION[\u0027_cid\u0027] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.\"},{\"lang\":\"es\",\"value\":\"Chamilo LMS es un sistema de gesti\u00f3n del aprendizaje de c\u00f3digo abierto. En versiones anteriores a la 2.0.0-RC.3, existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en el endpoint main/inc/ajax/gradebook.ajax.php dentro de la acci\u00f3n export_all_certificates, donde el c\u00f3digo del curso recuperado de la variable de sesi\u00f3n $_SESSION[\u0027_cid\u0027] a trav\u00e9s de api_get_course_id() se concatena directamente en una cadena de comandos shell_exec() sin saneamiento o escape utilizando escapeshellarg(). Si un atacante puede manipular o envenenar sus datos de sesi\u00f3n para inyectar metacaracteres de shell en la variable _cid, pueden lograr la ejecuci\u00f3n arbitraria de comandos en el servidor subyacente. La explotaci\u00f3n exitosa otorga acceso completo para leer archivos del sistema y credenciales, altera la aplicaci\u00f3n y la base de datos, o interrumpe la disponibilidad del servidor. Este problema ha sido solucionado en la versi\u00f3n 2.0.0-RC.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"chamilo\",\"product\":\"chamilo-lms\",\"versions\":[{\"version\":\"\u003c 2.0.0-RC.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-15T14:27:21.595475Z\",\"id\":\"CVE-2026-35196\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.11.38\",\"matchCriteriaId\":\"34085140-9203-4B20-9036-743718F1A4F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AF7661F-C1F7-4CAB-BBDF-FC5BF7F5BEB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE56AF71-9D53-42C6-980D-09E1C418ED87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"01195674-9E1A-4C07-B7D3-0F0CC2E6511B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAE63449-5A56-4302-A4BF-F3D19FC96A80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A84A06F9-5AB7-4703-8153-33AC68882B95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B91302A3-53DE-4ED0-BAAB-FE9DA03F8242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"46008D4A-96F7-4E04-8256-E115AAAE3383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E2BCAFF-D44B-4E67-998A-DF855E27606B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2E7D018-E4C2-45F5-8D9A-DAC947173607\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAF96697-6B6D-459D-9510-E5CEEDC2859B\"}]}]}],\"references\":[{\"url\":\"https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:09:57+00:00",
      "cve": "CVE-2026-35196",
      "id": "CVE-2026-35196",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Chamilo LMS has OS Command Injection via export_all_certificates action",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35196.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-35196\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T14:27:21.595475Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T14:27:26.606Z\"}}], \"cna\": {\"title\": \"Chamilo LMS has OS Command Injection via export_all_certificates action\", \"source\": {\"advisory\": \"GHSA-crc6-r6c7-44q3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"chamilo\", \"product\": \"chamilo-lms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.0-RC.3\"}]}], \"references\": [{\"url\": \"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3\", \"name\": \"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1\", \"name\": \"https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\", \"name\": \"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION[\u0027_cid\u0027] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-14T21:33:13.518Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-35196\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-15T14:27:29.401Z\", \"dateReserved\": \"2026-04-01T18:48:58.937Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-14T21:33:13.518Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.