Executive brief
ILIAS is a learning management platform with a MediaPool component that allows users to manage multimedia content. A flaw in the subtitle upload function allows authenticated users to upload files without proper restrictions, potentially enabling attackers to upload malicious files and compromise the system. This could lead to unauthorized code execution and data breach.
Technical details
The vulnerability is an unrestricted file upload flaw in the ilObjMediaObjectGUI::uploadMultipleSubtitleFile function within the MediaPool component (Services/Repository/Service/Resources/ZipAdapter.php). The vulnerability requires authentication, as it is accessed through the MediaPool interface. An authenticated attacker can exploit this to upload arbitrary files, potentially including executable code or other malicious payloads. The fix involves adding proper file validation and security checks, identified in commit b0d61be and others. Patches are available in ILIAS versions 9.22, 10.10, and 11.3.
Affected products
- ILIAS ILIAS up to 9.21, 10.9, 11.2
Timeline
- 2026-09-03: disclosed: CVE-2026-85135 published
- 2026-08-11: patched: Patch committed (b0d61be43671b6bfe91baf469a5ee11e764f2e23)
- 2026-08-11: patched: ILIAS 11.3 released with security fix