Executive brief
ILIAS is an open-source e-learning platform used by educational institutions to deliver online courses and manage learning content. An authenticated attacker can read arbitrary files from the server through the SOAP API, potentially exposing sensitive configuration files containing database credentials and setup passwords, compromising the entire system's security.
Technical details
The vulnerability is an arbitrary file read flaw in the SOAP addFile method of ILIAS. An authenticated user can craft malicious XML containing COPY-mode imports with absolute file paths that bypass the import directory sandbox, allowing them to traverse the filesystem and retrieve sensitive files such as configuration files with database credentials. The attack requires valid authentication credentials and network access to the SOAP endpoint. Patches are available in versions 9.22, 10.10, and 11.3 or later.
Affected products
- ILIAS eLearning ILIAS before 9.22, 10.10, and 11.3
Timeline
- 2026-08-31: disclosed