Ilias vulnerabilities
We track 7 vulnerabilities in Ilias products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 6, 2025.
Latest Ilias vulnerabilities
- 9.8 Critical severity
A vulnerability has been found in ILIAS up to 8.23/9.13/10.1.
A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. U
- 9.8 Critical severity
ILIAS: Deserialization of Untrusted Data
A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and
- 9.8 Critical severity
ILIAS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgr
- 7.2 High severity
ilias: Improper Neutralization of Special Elements used in an OS Command
ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types.
- 7.1 High severity
ilias: Improper Neutralization of Input During Web Page Generation
A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or
- 9.0 Critical severity
Ilias: Improper Neutralization of Input During Web Page Generation
ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of th
- 8.1 High severity
Ilias: Improper Limitation of a Pathname to a Restricted Directory
The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can mov