Arbitrary File Read Vulnerability in ILIAS Software by ILIAS eLearning
CVE-2026-82877

7.1HIGH

Key Information:

Vendor

Ilias-elearning E.v.

Status
Ilias
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82877?

ILIAS software versions prior to 9.22 and various versions from 10.0 to 11.2 are susceptible to an arbitrary file read vulnerability via the SOAP addFile method. This flaw allows authenticated users to supply specially crafted XML with COPY-mode imports, enabling them to read server files by constructing absolute file paths from an unsandboxed import directory. Through this vulnerability, attackers can potentially access sensitive files, including critical configuration files that may store database credentials and setup passwords.

Affected Version(s)

ILIAS 0 < 9.22

ILIAS 10.0 < 10.10

ILIAS 11.0 < 11.3

References

https://github.com/ILIAS-eLearning/ILIAS/commit/e9acd3f8d...
patch
https://github.com/ILIAS-eLearning/ILIAS/blob/v11.2/compo...
technical-description
https://github.com/ILIAS-eLearning/ILIAS/blob/v11.2/compo...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

André Schweigert
.