CVE-2026-82877

ILIAS, an open-source learning management system, contains an arbitrary file read vulnerability (CWE-22 path traversal) in the SOAP addFile method, patched in versions 9.22, 10.10, and 11.3. An authenticated user can trigger the flaw by submitting a crafted SOAP request whose XML initiates a COPY-mode import with an absolute file path that is not confined to the sandboxed import directory, causing the server to expose arbitrary files. Successful exploitation grants read access to sensitive server files, including configuration files that contain database credentials and setup passwords, yielding high confidentiality impact but no integrity or availability impact (CVSS 4.0: 7.1 High, network vector, low privileges required). Any organization running ILIAS prior to the fixed versions is affected, which — given ILIAS's concentration in universities, schools, and public-sector organizations in the DACH region — implies a broad institutional user base. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; EPSS currently assigns roughly a 0.4% probability of exploitation within 30 days (29th percentile).

What to do: Upgrade ILIAS 9.x deployments to 9.22, 10.x to 10.10, and 11.x to 11.3 or later; sites on older major branches should confirm patch availability with the vendor or ILIAS community. Restrict SOAP service access to trusted authenticated accounts, and because the flaw can expose configuration files, rotate database credentials and setup passwords if compromise is suspected; review SOAP addFile request logs for imports referencing absolute paths outside the import directory.