The vulnerability arises when the export_all_certificates action in the gradebook AJAX endpoint concatenates the course identifier from the session directly into a shell command without sanitization. An attacker able to alter or poison their session data can inject shell metacharacters and execute arbitrary system commands on the server hosting Chamilo. Such exploitation would provide the attacker with full read and write access to the file system, the ability to modify application or database files, and the potential to disrupt server availability.

Chamilo LMS, the open‑source learning management system. Versions released before 2.0.0‑RC.3 are affected. All deployments using those earlier releases may be vulnerable if the export_all_certificates endpoint is reachable.

The vulnerability has a CVSS score of 8.8 and is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by manipulating session data to inject shell characters. The probability of exploitation is currently unknown due to missing EPSS data, but the high severity score indicates significant risk if the conditions are met.