CVE-2026-85135 in ILIAS
Summary
by MITRE • 09/03/2026
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in ILIAS versions up to 9.21, 10.9, and 11.2 represents a critical security flaw within the MediaPool component, specifically affecting the file upload functionality for subtitle files. The issue resides in the ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject function located in Services/Repository/Service/Resources/ZipAdapter.php. This architectural weakness allows an attacker to bypass intended access controls and perform unrestricted file uploads. By exploiting this flaw, a malicious actor can inject arbitrary files into the system's media repository without proper validation or authorization checks. The nature of this vulnerability aligns with CWE-434, which describes the dangerous behavior of uploading and executing user-controlled files, as well as CWE-798, concerning the use of hardcoded credentials if authentication bypasses are involved in the broader attack chain.
From an operational perspective, the ability to upload unrestricted files remotely poses a severe risk to system integrity and confidentiality. An attacker leveraging this vulnerability could potentially deploy web shells or other malicious scripts onto the server hosting ILIAS. This action would grant the attacker persistent access to the underlying operating system, enabling further exploitation such as data exfiltration, lateral movement within the network, or complete compromise of the application environment. The remote nature of the attack vector means that no local access or physical proximity is required, significantly lowering the barrier for entry and increasing the likelihood of successful exploitation by automated scanning tools targeting known vulnerable versions.
The technical root cause lies in insufficient input validation and lack of strict file type verification within the ZipAdapter logic when handling multiple subtitle uploads. The system fails to adequately sanitize filenames or inspect file contents before processing them into the media pool, allowing executable code disguised as valid subtitle files to be saved directly to accessible directories. This oversight violates fundamental secure coding principles regarding trust boundaries and input validation, which are critical in web application security frameworks like OWASP Top 10, particularly under categories related to Broken Access Control and Injection vulnerabilities.
To mitigate this risk, immediate action is required by upgrading the ILIAS installation to version 9.22, 10.10, or 11.3, where these specific patches have been applied. The provided patch identifiers ef5d7f99fe1ea0381db04b333a2906548b3590e4 and b0d61be43671b6bfe91baf469a5ee11e764f2e23 address the logic errors in the ZipAdapter component, enforcing stricter validation rules for uploaded files. Administrators should verify their current version immediately and apply the update through official channels to ensure all security fixes are integrated. Additionally, implementing web application firewalls with robust file upload inspection capabilities can provide an additional layer of defense against similar exploitation attempts while patching is being processed.