Is CVE-2026-82877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82877 being exploited in the wild.

How severe is CVE-2026-82877?

Medium severity, with a CVSS score of 6.5, published 31 August 2026.

Which products and versions are affected?

ILIAS eLearning ILIAS before 9.22, 10.10, and 11.3.

Is there a fix for CVE-2026-82877?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82877 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82877?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82877: ILIAS arbitrary file read in SOAP addFile method

CVE-2026-82877 · Severity: medium · CVSS 6.5 · Published 2026-08-31

ILIAS is an open-source e-learning platform used by educational institutions to deliver online courses and manage learning content. An authenticated attacker can read arbitrary files from the server through the SOAP API, potentially exposing sensitive configuration files containing database credentials and setup passwords, compromising the entire system's security.

Quick answers

Is CVE-2026-82877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82877 being exploited in the wild.
How severe is CVE-2026-82877?: Medium severity, with a CVSS score of 6.5, published 31 August 2026.
Which products and versions are affected?: ILIAS eLearning ILIAS before 9.22, 10.10, and 11.3.
Is there a fix for CVE-2026-82877?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82877 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82877?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an arbitrary file read flaw in the SOAP addFile method of ILIAS. An authenticated user can craft malicious XML containing COPY-mode imports with absolute file paths that bypass the import directory sandbox, allowing them to traverse the filesystem and retrieve sensitive files such as configuration files with database credentials. The attack requires valid authentication credentials and network access to the SOAP endpoint. Patches are available in versions 9.22, 10.10, and 11.3 or later.

Affected products

ILIAS eLearning ILIAS before 9.22, 10.10, and 11.3

Timeline

2026-08-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.