Submit #892842: ILIAS open source e-Learning e.V. ILIAS 9/10/11/12 Code Injection

EARLY CVE RESERVATION UNDER EMBARGO

We request the reservation of a CVE identifier only.

Please do not publish the VulDB entry, the raw submission, the CVE record, technical details, references, or proof-of-concept information before the coordinated release of the patched version.

ILIAS 9/10/11/12 Media Object Multi-Subtitle Upload ZipAdapter Unrestricted Upload Remote Code Execution:

A vulnerability was found in ILIAS 9, 10, 11 and 12. It affects the function uploadMultipleSubtitleFile of the Media Object subtitle-upload component, reachable through the "upload multiple subtitles" feature of a media object. The GUI handler ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject() performs no dedicated permission check and is only gated by the edit right of the embedding content, so any authenticated user able to edit such content can reach it.

The handler moves the uploaded ZIP archive into a directory below the web-served webspace path (.../mobs/mm_<id>/srt/tmp/) and extracts it via ZipAdapter::unzipFile(). The extraction was performed verbatim (ZipDirectoryHandling::KEEP_STRUCTURE, raw ZipArchive::extractTo), with no extension whitelist and an ignore-list limited to ['.DS_','__MACOSX']. Every archive entry — including server-side scripts (shell.php) and per-directory configuration files (.htaccess) — was therefore written unchanged into the web-served directory.

Although deep requests under data/ are normally routed to the ILIAS WebAccessChecker (wac.php), the same unrestricted extraction lets an attacker also drop an .htaccess file containing RewriteEngine Off. On a common configuration (AllowOverride All, global mod_php handler) this disables the WebAccessChecker rewrite for the directory, and the uploaded PHP script is executed, resulting in remote code execution in the context of the web-server user. The behavior was confirmed dynamically on an authorized test instance.

The manipulation with an unknown input leads to an unrestricted upload and, in consequence, to code execution. The attack can be launched remotely, requires only a low-med-privileged authenticated account, and needs no user interaction. A proof of concept was created and privately verified; it is not disclosed.

The vulnerability was reported to the vendor (ILIAS) as part of a coordinated disclosure.

• Benutzer: andre.schweigert (UID 99813)
• Einreichung: 16.07.2026 11:20 (vor 2 Monaten)
• Moderieren: 03.09.2026 10:46 (2 months later)
• Status: Akzeptiert
• VulDB Eintrag: 398335 [ILIAS bis 9.21/10.9/11.2 MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject erweiterte Rechte]
• Punkte: 17