Title: Chamilo LMS de Chamilo, Description: Chamilo LMS es un sistema de gestión del aprendizaje de código abierto. En versiones anteriores a la 2.0.0-RC.3, existe una vulnerabilidad de inyección de comandos del sistema operativo en el endpoint main/inc/ajax/gradebook.ajax.php dentro de la acción export_all_certificates, donde el código del curso recuperado de la variable de sesión $_SESSION['_cid'] a través de api_get_course_id() se concatena directamente en una cadena de comandos shell_exec() sin saneamiento o escape utilizando escapeshellarg(). Si un atacante puede manipular o envenenar sus datos de sesión para inyectar metacaracteres de shell en la variable _cid, pueden lograr la ejecución arbitraria de comandos en el servidor subyacente. La explotación exitosa otorga acceso completo para leer archivos del sistema y credenciales, altera la aplicación y la base de datos, o interrumpe la disponibilidad del servidor. Este problema ha sido solucionado en la versión 2.0.0-RC.3.

{"timestamp":"2026-04-15T14:27:21.595475Z","id":"CVE-2026-35196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"chamilo","product":"chamilo-lms","versions":[{"version":"< 2.0.0-RC.3","status":"affected"}]}]

OR
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*
          *cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* versions up to (including) 1.11.38

GitHub, Inc.: https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1 Types: Patch

GitHub, Inc.: https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 Types: Product, Release Notes

GitHub, Inc.: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3 Types: Exploit, Vendor Advisory

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-78

https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1

https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3