Description

An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T05:16:57.137Z",
  "pubdate": "2026-09-14T05:16:57.137Z",
  "executiveSummary": "An arbitrary code execution vulnerability has been identified in the ILIAS learning management system, specifically impacting versions 6.23, 7 prior to 7.22, and 8.1. The vulnerability stems from improper validation and handling of ZIP file uploads, allowing an authenticated attacker to bypass file type restrictions and upload malicious payloads.\nThis flaw enables an attacker to achieve remote code execution (RCE) on the underlying web server by injecting executable files disguised as legitimate archive contents. The impact of successful exploitation is critical, as it facilitates full system compromise, unauthorized data exfiltration, lateral movement within the network, and complete control over the affected application instance.\nExploitation requires the attacker to have an account with sufficient privileges to perform file upload operations within the ILIAS environment. Given the potential for complete system takeover, this vulnerability poses a severe risk to organizational infrastructure. Organizations are advised to update to the patched versions immediately to remediate the vulnerability.",
  "technicalDetails": "The vulnerability originates from insufficient validation of user-supplied archive files during the upload process in ILIAS. The application fails to adequately sanitize or verify the contents and file extensions of ZIP archives before processing them on the server-side. This lack of rigorous input validation allows for directory traversal or direct injection of malicious script files (e.g., .php files) into web-accessible directories.\nThe attack flow typically involves an attacker crafting a malicious ZIP file containing a web shell or other malicious script. When this file is uploaded through the ILIAS interface, the application extracts or processes the archive without verifying that the contained files are restricted to authorized formats. If the extraction process results in the placement of a script file within a directory where the web server is configured to execute scripts (such as the document root or specific upload directories), the attacker can subsequently trigger the execution of the payload by requesting the malicious file directly via a standard HTTP GET request.\nThe root cause is a failure in the application's file handling logic, which does not enforce strict extension filtering or content inspection on decompressed or processed archive members. This effectively permits the bypass of existing security controls intended to limit file uploads to safe media types. By manipulating the path or metadata within the ZIP archive, an attacker can influence where the file is written, facilitating execution in a context where the server interprets the script.\nThe attack surface includes any component of ILIAS that processes ZIP uploads. Because the vulnerability allows for arbitrary code execution, an attacker can gain the privileges of the web server service account. Post-exploitation activities may include persistent backdooring of the server, unauthorized access to the application database, modification of user data, and the potential for privilege escalation to the underlying operating system. This vulnerability is applicable to network-exposed instances and does not require sophisticated client-side exploitation, relying instead on the inherent trust the application places in the uploaded archive structure."
}