André Schweigert

CVE-2026-82538 SQLi in ILIAS (<9.22, 10.10, 11.3) lets authenticated users with container write access inject arbitrary SQL via sort param. CVSS 8.8. Unpatched—act now. Details: https://t.co/Emh3Jd8yiK #ILIAS #valtersit #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker #kali

**Name of the Vulnerable Software and Affected Versions** ILIAS versions prior to 9.22 ILIAS versions 10.0 through 10.9 ILIAS versions 11.0 through 11.2 **Description** An arbitrary file read issue exists in the SOAP `addFile()` method. Authenticated users can read server files by providing crafted XML using COPY-mode imports. This is possible because an unsandboxed import directory allows the construction of absolute file paths, enabling the retrieval of sensitive data such as configuration files containing database credentials and setup passwords. **Recommendations** Update ILIAS to version 9.22 or later. Update ILIAS to version 11.0 or later (specifically versions beyond 10.9). Update ILIAS to version 11.3 or later.

**Name of the Vulnerable Software and Affected Versions** ILIAS (affected versions not specified) **Description** An unauthenticated caller can trigger the deserialization of stored session data. The Shibboleth back-channel endpoint 'components/ILIAS/AuthShibboleth/resources/shib logout.php' operates in a context exempt from authentication. Its logout-notification handler iterates through all live rows of the session table and passes the stored data to a parser that uses `unserialize` without restricting class construction. This allows serialized objects to be instantiated during an anonymous request, triggering object destructors upon disposal. An attacker can inject a serialized object into a session row via the LTI authentication entry point, which stores request parameters into the session and is also exempt from authentication. By leveraging a bundled class that writes JSON-encoded structures to a file based on its own properties during destruction, an attacker can place controlled content at a chosen path below the web root, leading to remote code execution as the web server user. **Recommendations** Update to version 9.22, 10.10, or 11.3 to remove the vulnerable logout-notification implementation.