CVE-2026-35196 - Vulnerability Analysis

Overview

Chamilo LMS < 2.0.0-RC.3 contains a command injection caused by unsanitized concatenation of course code from session variable in main/inc/ajax/gradebook.ajax.php export_all_certificates action, letting attackers execute arbitrary OS commands, exploit requires session data manipulation.

Severity & Score

Impact

Attackers can execute arbitrary commands, leading to full system compromise, data alteration, and denial of service.

Mitigation

Update to version 2.0.0-RC.3 or later.

References

• https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner