Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82877ILIAS Arbitrary File Read via SOAP addFile

Medium 6.5

In plain English

A medium-severity path traversal in ILIAS from ILIAS-eLearning e.V.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.

Affected products (as reported)

Vendor	Product	Versions
ILIAS-eLearning e.V.	ILIAS	9.0 – before 9.2210.0 – before 10.1011.0 – before 11.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

11.3 Release Notes release-notes
11.3 Download product, patch
10.10 Release Notes release-notes
10.10 Download product, patch
9.22 Release Notes release-notes
9.22 Download product, patch
https://www.vulncheck.com/advisories/ilias-arbitrary-file-read-via-soap-addfile third-party-advisory
Researcher Advisory technical-description