CVE-2026-82538

CVE-2026-82538 is a SQL injection flaw (CWE-89) in ILIAS, an open-source learning management system, located in the repository trash table, where the sort field taken from HTTP requests is inserted directly into a SQL ORDER BY clause without being validated against the declared sortable columns. Any authenticated user holding write permission on at least one repository container can trigger it by submitting a crafted sort parameter. Because ILIAS's database layer permits multi-statement execution, the injection supports stacked queries, giving the attacker full read and write access to the entire database and the ability to take over administrator accounts. All ILIAS deployments running versions below 9.22, 10.10, or 11.3 (depending on the major release line) are affected. No public proof-of-concept or in-the-wild exploitation is currently known; EPSS assigns a 0.4% probability of exploitation within 30 days and the flaw is not in CISA KEV.

What to do: Upgrade to ILIAS 9.22, 10.10, or 11.3, matching your current major release line. As an interim mitigation, consider restricting the database account used by ILIAS so it cannot execute stacked/multiple statements, and monitor access logs for suspicious characters (quotes, semicolons, SQL comments) in the sort parameter on repository trash table requests. Because the flaw permits full database write and administrator account takeover, review administrator accounts and recent administrative changes for signs of tampering.