CVE-2026-85135: Unrestricted Upload in ILIAS
Description
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.
CVSS v4.0
Score 5.3medium
Affected software
ILIAS
cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the file Services/Repository/Service/Resources/ZipAdapter.php of the MediaPool component in ILIAS. The function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject improperly restricts file uploads, enabling an attacker to upload files without limitation. The vulnerability affects multiple versions up to 9.21, 10.9, and 11.2. The vendor has released patched versions 9.22, 10.10, and 11.3 that address this issue. The patch is identified by commits ef5d7f99fe1ea0381db04b333a2906548b3590e4 and b0d61be43671b6bfe91baf469a5ee11e764f2e23.
Potential Impact
The vulnerability allows remote attackers to upload files without restriction, which could lead to unauthorized file uploads on the affected system. This may facilitate further attacks depending on the nature of the uploaded files. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.
Mitigation Recommendations
A fix is available by upgrading ILIAS to versions 9.22, 10.10, or 11.3. It is recommended to apply these updates promptly to mitigate the vulnerability. No other mitigation or temporary workaround is indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-03T08:46:37.781Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9982b8acd9273b4909fd6d
Added to database: 09/03/2026, 14:22:48 UTC
Last enriched: 09/07/2026, 13:07:32 UTC
Last updated: 10/19/2026, 18:48:24 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.