ILIAS-eLearning e.V. vulnerabilities
We track 5 vulnerabilities in ILIAS-eLearning e.V. products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest ILIAS-eLearning e.V. vulnerabilities
- 8.8 High severity
ILIAS: Deserialization of Untrusted Data
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence s
- 8.8 High severity
ILIAS: Unrestricted Upload of File with Dangerous Type
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can impo
- 8.8 High severity
ILIAS: Improper Neutralization of Argument Delimiters in a Command
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated
- 8.8 High severity
ILIAS: Improper Neutralization of Special Elements used in an SQL Command
ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against decl
- 9.8 Critical severity
ILIAS: Deserialization of Untrusted Data
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering de