Description

ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 contain an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T11:16:41.330Z",
  "pubdate": "2026-08-31T11:16:41.330Z",
  "executiveSummary": "ILIAS versions 9.x before 9.22, 10.x through 10.9, and 11.x through 11.2 are susceptible to an arbitrary file read vulnerability located within the SOAP API implementation. The flaw exists in the addFile method, where insufficient validation of import parameters allows authenticated users to access arbitrary files on the underlying host filesystem.\nBy manipulating XML input during a COPY-mode import, an attacker can bypass directory restrictions to read sensitive server-side files, including configuration files containing database credentials and setup passwords. This vulnerability poses a significant risk to the confidentiality and integrity of the ILIAS instance, as leaked credentials could facilitate full system compromise or unauthorized access to sensitive user data. Successful exploitation requires an authenticated session, though the impact of unauthorized file retrieval often leads to total service takeover in hosted environments.",
  "technicalDetails": "The vulnerability resides in the ILIAS SOAP service component, specifically within the logic governing the addFile method. This method is designed to handle file imports, but it fails to adequately sanitize or sandbox the file path arguments provided within the XML payload during COPY-mode operations.\nExploitation is achieved by constructing a malicious XML request sent to the SOAP endpoint. By specifying an absolute path in the input parameters—effectively employing path traversal techniques—an attacker can escape the designated import directory. Because the application processes these requests with the privileges of the web server process, the server will read the targeted file as if it were a legitimate import stream.\nThe attack flow proceeds as follows: First, the attacker initiates a SOAP request using the addFile method. Second, they supply a crafted XML structure where the file path points to a sensitive target, such as a local configuration file (e.g., ilias.ini.php). Third, the SOAP handler processes the request without verifying the file path against an allow-list or performing adequate path normalization to prevent directory traversal. Finally, the application returns the contents of the requested file as part of the response, potentially through an error message or by displaying the content in a subsequent file-access step.\nThe root cause is an improper validation of input parameters in a high-privilege service function, allowing for an 'arbitrary file read' condition. The vulnerability affects ILIAS versions prior to 9.22, 10.0 through 10.9, and 11.0 through 11.2. The attack requires the user to be authenticated, meaning an attacker must possess valid credentials or hijack an active session to exploit the flaw. Post-exploitation impact is severe, as the retrieval of configuration files leads to the disclosure of database connection strings, administrative credentials, and other sensitive environment variables, enabling further lateral movement and persistent compromise."
}