# CVE-2026-85135: ILIAS unrestricted file upload in MediaPool

Source: https://junglewise.ai/threats/cve-2026-85135-ilias-unrestricted-file-upload-in-mediapool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85135 · Severity: medium · CVSS 6.3 · Published 2026-09-03

ILIAS is a learning management platform with a MediaPool component that allows users to manage multimedia content. A flaw in the subtitle upload function allows authenticated users to upload files without proper restrictions, potentially enabling attackers to upload malicious files and compromise the system. This could lead to unauthorized code execution and data breach.

## Quick answers

**Is CVE-2026-85135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85135 being exploited in the wild.

**How severe is CVE-2026-85135?** Medium severity, with a CVSS score of 6.3, published 3 September 2026.

**Which products and versions are affected?** ILIAS ILIAS up to 9.21, 10.9, 11.2.

**Is there a fix for CVE-2026-85135?** A patch was published on 2026-08-11: Patch committed (b0d61be43671b6bfe91baf469a5ee11e764f2e23) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85135 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85135?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unrestricted file upload flaw in the ilObjMediaObjectGUI::uploadMultipleSubtitleFile function within the MediaPool component (Services/Repository/Service/Resources/ZipAdapter.php). The vulnerability requires authentication, as it is accessed through the MediaPool interface. An authenticated attacker can exploit this to upload arbitrary files, potentially including executable code or other malicious payloads. The fix involves adding proper file validation and security checks, identified in commit b0d61be and others. Patches are available in ILIAS versions 9.22, 10.10, and 11.3.

## Affected products

- ILIAS ILIAS up to 9.21, 10.9, 11.2

## Timeline

- 2026-09-03: disclosed: CVE-2026-85135 published
- 2026-08-11: patched: Patch committed (b0d61be43671b6bfe91baf469a5ee11e764f2e23)
- 2026-08-11: patched: ILIAS 11.3 released with security fix

## References

- [https://github.com/ILIAS-eLearning/ILIAS/commit/b0d61be43671b6bfe91baf469a5ee11e764f2e23](https://github.com/ILIAS-eLearning/ILIAS/commit/b0d61be43671b6bfe91baf469a5ee11e764f2e23)
- [https://github.com/ILIAS-eLearning/ILIAS/releases/tag/v11.3](https://github.com/ILIAS-eLearning/ILIAS/releases/tag/v11.3)