PT-2026-32936 · Unknown · Chamilo Lms

Kx00007 · CVE-2026-35196 · Published 2026-04-14 · Updated 2026-04-15

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description An OS Command Injection issue exists in the 'main/inc/ajax/gradebook.ajax.php' endpoint within the export all certificates action. The course code retrieved from the $ SESSION[' cid'] session variable via the api get course id() function is concatenated directly into a shell exec() command string without proper sanitization or escaping. An attacker who can manipulate session data to inject shell metacharacters into the cid variable can execute arbitrary commands on the server, potentially allowing them to read system files and credentials, modify the application and database, or disrupt server availability.

Recommendations Update to version 2.0.0-RC.3.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-35196

GHSA-CRC6-R6C7-44Q3

Affected Products

Chamilo Lms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35196.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35196 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35196 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 · Note
• https://twitter.com/CVEnew/status/2044338918670454833 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044305540889628972 · Twitter Post