Impact

Successful exploitation leads to full server compromise, allowing unauthenticated attackers to execute arbitrary code, modify application data, and access sensitive files. The vulnerability affects all Chamilo LMS instances running version 2.0.0 or older. Given the high CVSS score of 9.8, the potential for data exfiltration and complete system takeover is high for affected organizations in the education and corporate learning sectors.

Recommendation

• Upgrade all Chamilo LMS installations to version 2.0.1 or later immediately to patch CVE-2026-45140.
• Audit webserver access logs for POST requests to the CStudio upload endpoint followed by direct requests to unusual files in the application's upload directory.
• Implement strict ingress filtering for web traffic to the application to minimize exposure to unauthenticated exploitation attempts.
• Review file system permissions on the web root to ensure that user-uploaded content directories do not have execution privileges.

Attack Chain

1. The attacker identifies a Chamilo LMS instance running a version prior to 2.0.0-RC.3.
2. The attacker gains a valid session, potentially through legitimate login or other means.
3. The attacker manipulates the _cid session variable, injecting shell metacharacters (e.g., ;, |, &&) and a malicious command. This can be achieved through browser developer tools or intercepting/modifying HTTP requests.
4. The attacker triggers the export_all_certificates action in the main/inc/ajax/gradebook.ajax.php endpoint.
5. The application retrieves the attacker-controlled _cid value from the session using api_get_course_id().
6. The application concatenates the unsanitized _cid value into a shell_exec() command.
7. The shell_exec() function executes the injected command on the server.
8. The attacker gains arbitrary command execution, allowing them to read sensitive files, modify the application, or disrupt the server.

Impact

Successful exploitation of CVE-2026-35196 allows an attacker to execute arbitrary commands on the Chamilo LMS server. This could lead to the compromise of sensitive data, including system files, credentials, and database contents. An attacker can also modify the application, inject malicious code, or disrupt server availability, leading to a complete loss of confidentiality, integrity, and availability. The number of potential victims is related to the number of unpatched Chamilo LMS instances exposed to the internet. Sectors affected may include education and training organizations.

Recommendation

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to patch CVE-2026-35196.
• Deploy the Sigma rule "Chamilo LMS OS Command Injection Attempt" to your SIEM and tune for your environment to detect attempts to exploit the vulnerability via web server logs.
• Monitor web server logs for suspicious requests to main/inc/ajax/gradebook.ajax.php containing shell metacharacters in the _cid parameter.
• Implement input validation and sanitization for all user-supplied data, especially session variables, to prevent command injection attacks.