Description

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-03T15:17:37.390Z",
  "pubdate": "2026-09-03T15:17:37.390Z",
  "executiveSummary": "A critical security vulnerability has been identified in the MediaPool component of ILIAS, specifically affecting the ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject function within the Services/Repository/Service/Resources/ZipAdapter.php file.\nThe vulnerability is classified as an Unrestricted File Upload flaw, which allows remote attackers to bypass validation mechanisms and upload arbitrary files to the server.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the affected systems, as successful exploitation can lead to Remote Code Execution (RCE), unauthorized data access, or system compromise.\nThe flaw affects all ILIAS installations up to versions 9.21, 10.9, and 11.2.\nThere are no specific prerequisite requirements for exploitation mentioned beyond remote network access; therefore, the vulnerability is highly critical for any internet-facing instance of the affected software.",
  "technicalDetails": "The vulnerability resides in the ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject function located within Services/Repository/Service/Resources/ZipAdapter.php. This function is responsible for handling the ingestion of subtitle files, presumably within a compressed archive format.\nThe root cause is an insufficient validation of file types and extensions during the upload and extraction process handled by the ZipAdapter. When a user interacts with the MediaPool functionality to upload multiple subtitle files, the application fails to properly verify the contents or the nature of the submitted files before persisting them to the server's filesystem.\nAn attacker can exploit this by crafting a malicious payload, such as a PHP web shell or other executable script, and packaging it within an archive processed by the vulnerable component. By initiating a multipart upload request to the affected function, the attacker forces the server to extract and save the malicious file in a directory that is potentially accessible via the web server.\nThe attack flow begins with the attacker identifying the target endpoint associated with ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject. The attacker then prepares an archive containing the malicious file. Upon submitting the request, the ZipAdapter processes the archive without sufficient sanitization or restriction on the file contents. If the application does not enforce a strict whitelist of file types or rename the uploaded files to non-executable extensions, the malicious file is written to the server's storage.\nOnce the file is successfully uploaded, the attacker can execute the code by navigating to the file's path through a standard HTTP GET request. The post-exploitation impact includes full system compromise, the ability to pivot into internal networks, exfiltration of sensitive organizational data, or the defacement of the ILIAS portal. The vulnerability persists across multiple versions, specifically ILIAS 9.x, 10.x, and 11.x, indicating a long-standing weakness in the archive processing logic of the MediaPool service."
}