Attack Chain

1. The attacker identifies a Chamilo LMS instance running a version prior to 2.0.0-RC.3.
2. The attacker gains a valid session, potentially through legitimate login or other means.
3. The attacker manipulates the _cid session variable, injecting shell metacharacters (e.g., ;, |, &&) and a malicious command. This can be achieved through browser developer tools or intercepting/modifying HTTP requests.
4. The attacker triggers the export_all_certificates action in the main/inc/ajax/gradebook.ajax.php endpoint.
5. The application retrieves the attacker-controlled _cid value from the session using api_get_course_id().
6. The application concatenates the unsanitized _cid value into a shell_exec() command.
7. The shell_exec() function executes the injected command on the server.
8. The attacker gains arbitrary command execution, allowing them to read sensitive files, modify the application, or disrupt the server.

Impact

Successful exploitation of CVE-2026-35196 allows an attacker to execute arbitrary commands on the Chamilo LMS server. This could lead to the compromise of sensitive data, including system files, credentials, and database contents. An attacker can also modify the application, inject malicious code, or disrupt server availability, leading to a complete loss of confidentiality, integrity, and availability. The number of potential victims is related to the number of unpatched Chamilo LMS instances exposed to the internet. Sectors affected may include education and training organizations.

Recommendation

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to patch CVE-2026-35196.
• Deploy the Sigma rule "Chamilo LMS OS Command Injection Attempt" to your SIEM and tune for your environment to detect attempts to exploit the vulnerability via web server logs.
• Monitor web server logs for suspicious requests to main/inc/ajax/gradebook.ajax.php containing shell metacharacters in the _cid parameter.
• Implement input validation and sanitization for all user-supplied data, especially session variables, to prevent command injection attacks.