CVE-2026-82877
MediumCVSS 6.5Summary
ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 contain an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.
Risk Assessment
An authenticated attacker can access sensitive server files, including credentials, potentially leading to full system compromise. Data confidentiality breaches can have severe consequences for the organization.
Recommendation
Update ILIAS to a patched version (9.22 or later, 10.10 or later, 11.3 or later). Also restrict access to the SOAP addFile method and sandbox the import directory.
Other vulnerabilities in ILIAS
See all- CVE-2026-80428Critical
ILIAS deserializes stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint lacks authentication, and the session parser uses unserialize without class restrictions, allowing code execution via malicious objects.
- CVE-2026-12789Medium
A SQL injection vulnerability was found in ILIAS Learning Management System 11.0 in the ilTrQuery::executeQueries function of the class.ilTrQuery.php file within the Learning Progress Tracking component. Manipulation of the troup_table_nav argument allows remote attack. The exploit is publicly available.
- CVE-2023-36484Medium
ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to reflected Cross-Site Scripting (XSS).
- CVE-2023-36488Medium
ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to stored Cross Site Scripting (XSS).
Original NVD description (English source)
ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 contain an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.