CVE-2026-82538
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A SQL injection vulnerability in ILIAS before versions 9.22, 10.10, and 11.3 exists in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.
Risk Assessment
The organization is exposed to full compromise of the ILIAS database, including data theft, content modification, and administrator account takeover. The vulnerability can be exploited by authenticated users with write permissions, increasing the risk of insider attacks.
Recommendation
Immediately update ILIAS to version 9.22, 10.10, or 11.3 (depending on the branch in use) or later. Until patched, restrict write permissions on containers and monitor for unusual HTTP requests with sort parameters.
Other vulnerabilities in ILIAS
See all- CVE-2026-85135Medium
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue.
- CVE-2026-80428Critical
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
- CVE-2023-32778Low
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.
- CVE-2026-86416Medium
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.
- CVE-2026-82877Medium
ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.
- CVE-2026-12789Medium
A SQL injection vulnerability was found in ILIAS Learning Management System 11.0 in the ilTrQuery::executeQueries function of the class.ilTrQuery.php file within the Learning Progress Tracking component. Manipulation of the troup_table_nav argument allows remote attack. The exploit is publicly available.
- CVE-2023-36484Medium
ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to reflected Cross-Site Scripting (XSS).
- CVE-2023-36488Medium
ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to stored Cross Site Scripting (XSS).
Original NVD description (English source)
ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS