CVE-2026-35196: 
Chamilo vulnerability analysis and mitigation

CVE-2026-35196 is an OS Command Injection vulnerability (CWE-78) in Chamilo LMS affecting the export_all_certificates action in main/inc/ajax/gradebook.ajax.php. An authenticated attacker with low privileges can manipulate their session data to inject shell metacharacters into the $_SESSION['_cid'] variable, achieving arbitrary command execution on the server. Affected versions include all releases up to and including 1.11.38 and 2.0.0 pre-release versions through RC.2 (alpha1–alpha5, beta1–beta3, RC1, RC2). The vulnerability was disclosed on April 14, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is improper neutralization of OS command special elements (CWE-78) in public/main/inc/ajax/gradebook.ajax.php. When the export_all_certificates action is triggered, the application retrieves the course code via api_get_course_id(), which reads directly from $_SESSION['_cid'], and concatenates it unsanitized into a shell_exec() call: shell_exec("php $commandScript $courseCode $sessionId $categoryId $userList > /dev/null &"). An attacker who can poison their session's _cid value with shell metacharacters (e.g., ; touch /tmp/pwned; #) causes the shell to execute the injected payload after the intended PHP script. The fix, applied in commit 62671e5, wraps all shell arguments with escapeshellarg() using sprintf() (GitHub Advisory, Fix Commit).

Successful exploitation grants an authenticated low-privilege attacker arbitrary OS command execution with the privileges of the web server process (e.g., www-data). This enables full confidentiality breach — reading system files, application source code, and database credentials — as well as integrity compromise through modification or deletion of application files and database contents. Availability can also be disrupted via resource exhaustion, file deletion, or ransomware deployment (GitHub Advisory).

Authentication is required (low-privilege user), but no user interaction or elevated privileges beyond a standard account are needed, making this accessible to any enrolled user who can manipulate their session. The GitHub Security Advisory notes the PoC details are marked confidential, and Feedly's analysis confirms no concrete exploit steps or runnable code are publicly available at this time. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and the EPSS score is approximately 0.00158 (low probability of exploitation in the near term) (GitHub Advisory, Feedly).

1. Authenticate: Log in to the target Chamilo LMS instance with any valid low-privilege account (e.g., a student or teacher account).
2. Session Poisoning: Identify a mechanism to manipulate the $_SESSION['_cid'] session variable. This may involve exploiting a secondary vulnerability (e.g., IDOR, session fixation, or direct session storage manipulation if accessible) to inject a malicious course code value such as COURSE1; <malicious_command>; #.
3. Trigger the Vulnerable Endpoint: Send an authenticated HTTP GET or POST request to main/inc/ajax/gradebook.ajax.php with the action=export_all_certificates parameter and a valid cat_id value (e.g., GET /main/inc/ajax/gradebook.ajax.php?action=export_all_certificates&cat_id=1).
4. Command Injection Execution: The server retrieves the poisoned $_SESSION['_cid'] value and constructs the shell command: php /path/to/export_all_certificates.php COURSE1; <malicious_command>; # ... > /dev/null &. The shell executes the injected payload with web server privileges.
5. Achieve Objective: Depending on the injected command, the attacker can establish a reverse shell, exfiltrate credentials from configuration files, or perform further lateral movement within the server environment (GitHub Advisory).

• Network: Unexpected outbound connections from the web server process to external IPs (potential reverse shell callbacks); unusual DNS lookups originating from the PHP/web server process.
• Logs: Web server access logs showing repeated requests to main/inc/ajax/gradebook.ajax.php with action=export_all_certificates from non-administrative users; PHP error logs showing unexpected command execution output or shell errors.
• File System: Unexpected files created in world-writable directories such as /tmp/ (e.g., test files like /tmp/remote_code_by_k); new or modified PHP files in the Chamilo web root; unauthorized SSH keys added to the web server user's home directory.
• Process: Unusual child processes spawned by the web server process (e.g., www-data spawning /bin/bash, curl, wget, nc, or python); background processes running unexpected PHP scripts.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which wraps all shell command arguments with escapeshellarg() via commit 62671e5 (Fix Commit, RC.3 Release). As interim mitigations: restrict access to the gradebook.ajax.php endpoint at the web server or WAF level for non-administrative users; enforce strict session validation and sanitization of $_SESSION['_cid'] at the application entry point; and apply the principle of least privilege to the web server process, limiting its filesystem write permissions and access to shell binaries (GitHub Advisory).

The vulnerability was reported by researcher kx00007 and published via GitHub Security Advisories on April 14, 2026. The Hacker Wire covered the issue with an article titled "Chamilo LMS RCE via Session Poisoning (CVE-2026-35196)," and a related post appeared on Mastodon from the same outlet. INCIBE (Spain's national cybersecurity agency) also published an early warning advisory. Community reaction has been moderate, with aggregators such as VulDB, CVEFeed, and Radar.offseq tracking the disclosure (GitHub Advisory).