CVE-2026-35196
Chamilo LMS has OS Command Injection via export_all_certificates action
Description
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.
INFO
Published Date :
April 14, 2026, 10:16 p.m.
Last Modified :
July 24, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Chamilo LMS to version 2.0.0-RC.3 or later.
- Verify the version of your Chamilo LMS installation.
- Apply security patches provided by the vendor.
Public PoC/Exploit Available at Github
CVE-2026-35196 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-35196.
| URL | Resource |
|---|---|
| https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1 | Patch |
| https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 | Product Release Notes |
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3 | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-35196 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-35196
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Just ask AI to do my task
Second CVE still Remote Code Execution
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-35196 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-35196 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: Chamilo LMS de Chamilo, Description: Chamilo LMS es un sistema de gestión del aprendizaje de código abierto. En versiones anteriores a la 2.0.0-RC.3, existe una vulnerabilidad de inyección de comandos del sistema operativo en el endpoint main/inc/ajax/gradebook.ajax.php dentro de la acción export_all_certificates, donde el código del curso recuperado de la variable de sesión $_SESSION['_cid'] a través de api_get_course_id() se concatena directamente en una cadena de comandos shell_exec() sin saneamiento o escape utilizando escapeshellarg(). Si un atacante puede manipular o envenenar sus datos de sesión para inyectar metacaracteres de shell en la variable _cid, pueden lograr la ejecución arbitraria de comandos en el servidor subyacente. La explotación exitosa otorga acceso completo para leer archivos del sistema y credenciales, altera la aplicación y la base de datos, o interrumpe la disponibilidad del servidor. Este problema ha sido solucionado en la versión 2.0.0-RC.3. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'chamilo', 'product': 'chamilo-lms', 'versions': [{'status': 'affected', 'version': '< 2.0.0-RC.3'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-35196', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-15T14:27:21.595475Z'} -
Initial Analysis by [email protected]
Apr. 22, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:* *cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* versions up to (including) 1.11.38 Added Reference Type GitHub, Inc.: https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 Types: Product, Release Notes Added Reference Type GitHub, Inc.: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3 Types: Exploit, Vendor Advisory -
New CVE Received by [email protected]
Apr. 14, 2026
Action Type Old Value New Value Added Description Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1 Added Reference https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 Added Reference https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3