Unrestricted File Upload Vulnerability in ILIAS MediaPool by ILIAS e-Learning
CVE-2026-85135

5.3MEDIUM

Key Information:

Vendor

ILIAS e-Learning

Status
Ilias
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85135?

A security vulnerability has been identified in ILIAS MediaPool that allows an attacker to perform unrestricted file uploads via the uploadMultipleSubtitleFileObject function. This weakness resides in the Services/Repository/Service/Resources/ZipAdapter.php file, enabling remote exploitation. To mitigate potential risks, users should upgrade to ILIAS versions 9.22, 10.10, or 11.3, which contain the necessary patches for this issue.

Affected Version(s)

ILIAS 9.0

ILIAS 9.1

ILIAS 9.2

References

https://vuldb.com/vuln/398335
vdb-entrytechnical-description
https://vuldb.com/vuln/398335/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-85135
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

andre.schweigert (VulDB User)
VulDB Vulnerability Moderation Team
.