CVE-2026-82877highCWE-22

CVE-2026-82877: fallo de gravedad alta en ILIAS-eLearning e.V. ILIAS

ILIAS Arbitrary File Read via SOAP addFile

Publicada el · Actualizada el

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.5%
probabilidad de explotación
0.5%top 55% de las CVE
explotación observada
noninguna fuente lo reporta
ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
ILIAS-eLearning e.V. · ILIAS
CVEs relacionadas — ILIAS-eLearning e.V. ILIAS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-80428CRITICALILIAS PHP Object Injection via Shibboleth LogoutEPSS 4.7%CVE-2026-107639HIGHILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload FilenameEPSS 0.7%CVE-2026-82538HIGHILIAS Arbitrary SQL Injection via Repository Trash Table Sort ParameterEPSS 0.7%CVE-2026-108113HIGHILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI ImportEPSS 0.6%CVE-2026-110761HIGHILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results ImportEPSS 0.6%CVE-2026-86416MEDIUMILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action MethodsEPSS 0.4%
Referencias
https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225630&ref_id=35https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225631&ref_id=35https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225632&ref_id=35https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=934https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=935https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=936https://schweigertit.de/en/advisories/SIT-2026-003.htmlhttps://www.vulncheck.com/advisories/ilias-arbitrary-file-read-via-soap-addfile