Read the docs
TI-2026-56895 Aliases CVE-2026-82538GHSA-p46r-q73m-mm69

ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00673 52nd percentileScored 2026-11-07
Fix Fixed ILIAS (ILIAS-eLearning e.V.): 9.22, 10.10, 11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ILIAS-eLearning e.V.ILIAS9.0 to before 9.22; 10.0 to before 10.10; 11.0 to before 11.39.22, 10.10, 11.3Patch availableCNA
  • ILIAS VendorILIAS-eLearning e.V. Affected 9.0 to before 9.22; 10.0 to before 10.10; 11.0 to before 11.3 Fixed in 9.22, 10.10, 11.3 Patch available CNA

Remediation

  • Fix · CNA ILIAS (ILIAS-eLearning e.V.) Fixed in 9.22, 10.10, 11.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82538
  2. 2026-10-03 Alias added: GHSA-p46r-q73m-mm69

References

Patch 3

Other 4

  • TI-2026-55506 ILIAS PHP Object Injection via Shibboleth Logout CVSS 4.0CRITICAL 9.3
  • TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run code CVSS 4.0HIGH 8.7
  • TI-2026-69589 Argument injection in ILIAS image map uploads enables code execution CVSS 4.0HIGH 8.7
  • TI-2026-74420 PHP object injection in ILIAS test results import CVSS 4.0HIGH 8.7
  • TI-2026-57181 ILIAS Arbitrary File Read via SOAP addFile CVSS 4.0HIGH 7.1
  • TI-2026-59124 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences