Is CVE-2026-35196 actively exploited?

No active exploitation of CVE-2026-35196 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-35196 be exploited remotely?

Yes. CVE-2026-35196 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-35196?

CVE-2026-35196 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-35196

HIGH

CVE-2026-35196

CWE-78Published: April 14, 2026· Updated: Apr 17, 2026

8.8

CVSS v3.1

EPSS:0.12%probability of exploitation in 30 daysPercentile:30.7th

Official Description

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3.

NVD Source

Technical Analysis

CVE-2026-35196 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.