What is the CVSS score of CVE-2026-35196?

CVE-2026-35196 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-35196?

Chamilo LMS versions prior to 2.0.0-RC.3 contain a command injection vulnerability in the gradebook certificate export feature that allows authenticated users with low-privilege accounts to execute…. A patch is available.

How to fix or mitigate CVE-2026-35196?

Within 24 hours: Identify all Chamilo LMS instances and document current versions. Within 7 days: Upgrade all Chamilo LMS deployments to version 2.0.0-RC.3 or later; disable certificate export functionality if immediate patching is not feasible. Within 30 days: Conduct security audit of Chamilo user accounts and session logs to identify any suspicious certificate export activity; review system command execution logs for unauthorized commands.

PHP CVE-2026-35196

EUVD-2026-22722 HIGH

OS Command Injection (CWE-78)

2026-04-14 security-advisories@github.com

PHP Command Injection

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 22, 2026 - 18:37 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3

Analysis Generated

Apr 14, 2026 - 22:42 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22722

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.

AnalysisAI

OS command injection in Chamilo LMS prior to 2.0.0-RC.3 allows authenticated attackers to execute arbitrary system commands via session poisoning of the course ID parameter. Attackers with low-privilege accounts can manipulate the $_SESSION['_cid'] variable to inject shell metacharacters into shell_exec() calls in the gradebook certificate export functionality, achieving full system compromise. CVSS 8.8 (High) with network attack vector and low complexity. No public exploit identified at time of analysis, though technical details are disclosed in the GitHub advisory. EPSS data not available for this recent CVE.

Technical ContextAI

This vulnerability affects the Chamilo Learning Management System, a PHP-based open-source e-learning platform. The flaw resides in main/inc/ajax/gradebook.ajax.php within the export_all_certificates action handler. The code retrieves the course identifier via api_get_course_id(), which reads from the session variable $_SESSION['_cid'], and passes this value directly into a shell_exec() command without sanitization using escapeshellarg() or equivalent input validation. CWE-78 (OS Command Injection) occurs when untrusted data flows into system shell commands. In PHP, shell_exec() executes commands through the system shell, making it vulnerable to metacharacter injection (semicolons, pipes, backticks, etc.) if inputs are not properly escaped. The session-based attack vector is particularly dangerous because session data can be poisoned through various means including session fixation, deserialization flaws, or other session manipulation techniques depending on the application's session handling implementation.

RemediationAI

Upgrade immediately to Chamilo LMS version 2.0.0-RC.3 or later, available at https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3. The fix implements proper input sanitization using escapeshellarg() to neutralize shell metacharacters before passing the course ID to shell_exec() commands, as documented in commit 62671e5e268f235cddfba704edee90f35c234df1. Until patching is completed, consider implementing application-layer controls such as restricting access to the gradebook certificate export functionality through web application firewall rules targeting main/inc/ajax/gradebook.ajax.php or temporarily disabling the export_all_certificates feature if operationally feasible. Review session management configurations to ensure session data integrity and monitor for suspicious patterns in course ID parameters within session storage. Organizations unable to immediately upgrade should prioritize network segmentation to limit potential lateral movement following compromise and implement enhanced monitoring for shell command execution anomalies.