Executive brief
Chamilo LMS, an open-source learning management system, contains a security flaw in how it handles certificate exports. An authenticated user can manipulate their session data to run unauthorized commands on the server hosting the application. This could allow an attacker to steal sensitive student or administrative data, modify system files, or take the entire learning platform offline.
Technical details
An OS command injection vulnerability exists in the 'export_all_certificates' action within 'main/inc/ajax/gradebook.ajax.php'. The application retrieves a course ID from the session variable '$_SESSION[\'_cid\']' and concatenates it directly into a 'shell_exec()' call without sanitization or escaping via 'escapeshellarg()'. An attacker who can influence their session data (e.g., via session poisoning) can inject shell metacharacters to execute arbitrary system commands with the privileges of the web server user. This issue is resolved in version 2.0.0-RC.3 by properly escaping shell arguments.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-01: patched: Version 2.0.0-RC.3 released
- 2026-04-14: advisory: GitHub Security Advisory published
- 2026-04-14: disclosed: CVE-2026-35196 published