A critical OS command injection vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code on the underlying server, potentially leading to a full system compromise.

This vulnerability is an OS command injection flaw (CWE-78) located in the main/inc/ajax/gradebook.ajax.php endpoint. By manipulating session data to inject shell metacharacters into the course ID parameter, an authenticated user can force the application to execute arbitrary commands via shell_exec().

The exploitation of this flaw grants an attacker full control over the application server. With a CVSS score of 8.8, this vulnerability poses a significant risk to data confidentiality, integrity, and availability, as unauthorized actors could exfiltrate sensitive student or administrative records, modify database contents, or render the learning management system completely inoperable.

Immediate Action: Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to apply the necessary input sanitization and command escaping.

Proactive Monitoring: Monitor server access logs for suspicious activity targeting the gradebook.ajax.php endpoint and alert on any shell-related syntax appearing in session variables or request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection patterns, such as character sequences like backticks or semicolon-delimited commands in HTTP parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository kx00007/CVE-2026-35196.

Given the severity of potential remote code execution and the availability of public exploit code, administrators must prioritize patching this vulnerability immediately. Failure to update the affected software exposes the entire server infrastructure to unauthorized administrative access and potential ransomware or data theft scenarios.