OS Command Injection in Chamilo LMS by Chamilo Foundation

CVE-2026-35196

What is CVE-2026-35196?

Chamilo LMS, an open-source learning management system, has a vulnerability that allows OS Command Injection through the main/inc/ajax/gradebook.ajax.php endpoint. This vulnerability arises from the improper handling of the course code from session variables, allowing an attacker to inject shell metacharacters into a command string executed by the system. This can lead to arbitrary command execution on the server, granting potential access to sensitive system files and credentials, altering the application, database, or causing server disruptions. The issue is resolved in version 2.0.0-RC.3.

References