Is CVE-2026-35196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35196 being exploited in the wild.

How severe is CVE-2026-35196?

High severity, with a CVSS score of 8.8, published 14 April 2026.

Is there a fix for CVE-2026-35196?

A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35196 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-35196?

Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35196: Chamilo LMS OS command injection in gradebook certificate export

CVE-2026-35196 · Severity: high · CVSS 8.8 · Published 2026-04-14

Chamilo LMS, an open-source learning management system, contains a security flaw in how it handles certificate exports. An authenticated user can manipulate their session data to run unauthorized commands on the server hosting the application. This could allow an attacker to steal sensitive student or administrative data, modify system files, or take the entire learning platform offline.

Technologies: Chamilo Lms. Vendors: Chamilo.

Quick answers

Is CVE-2026-35196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35196 being exploited in the wild.
How severe is CVE-2026-35196?: High severity, with a CVSS score of 8.8, published 14 April 2026.
Which products and versions are affected?: Chamilo Lms < 2.0.0-RC.3.
Is there a fix for CVE-2026-35196?: A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35196 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-35196?: Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the 'export_all_certificates' action within 'main/inc/ajax/gradebook.ajax.php'. The application retrieves a course ID from the session variable '$_SESSION[\'_cid\']' and concatenates it directly into a 'shell_exec()' call without sanitization or escaping via 'escapeshellarg()'. An attacker who can influence their session data (e.g., via session poisoning) can inject shell metacharacters to execute arbitrary system commands with the privileges of the web server user. This issue is resolved in version 2.0.0-RC.3 by properly escaping shell arguments.

Affected products

Chamilo Chamilo LMS < 2.0.0-RC.3

Timeline

2026-04-01: patched: Version 2.0.0-RC.3 released
2026-04-14: advisory: GitHub Security Advisory published
2026-04-14: disclosed: CVE-2026-35196 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.