Security-Blog
October 2026
Following 19 security issues have been resolved:
0047077: File Services: Prohibited file suffixes bypassable
0048028: Authenticated RCE via Test import
0048072: Authenticated RCE via CmiXapi
0048213: Stored XSS in the news
0048292: Unauthenticated test-question rendering
0048298: Fix forum attachment download processes ignored forum binding
0048313: Unauthenticated user and role enumeration via calendar
0048359: Close RCE in ImageMap Question by Removing Unnecessary Code
0048362: Broken access control in MyStaff
0048365: Fix file deletion through uncaught file traversal opportunity in SingleChoice, MultipleChoice, KPrim, Matching, and Ordering Questions
0048366: Stored XSS in SCORM tracking reports
0048373: Protect Additional Function Commands By Write
0048374: Add Access Checks and Filtering to Result-Functions for Administrators
0048402: Prevent Accessing Anonymous Test Run by Providing Active Id Only
0048413: RCE via questionpool import
0048414: RCE in ImageMapQuestion
0048418: Stored XSS in mail
0048447: Anonymous user enumeration via Survey
0048453: File: Anonymous users could download file objects without permission when the public area was enabled.
Following 19 security issues have been resolved:
0047077: File Services: Prohibited file suffixes bypassable
0048028: Authenticated RCE via Test import
0048072: Authenticated RCE via CmiXapi
0048213: Stored XSS in the news
0048292: Unauthenticated test-question rendering
0048298: Fix forum attachment download processes ignored forum binding
0048313: Unauthenticated user and role enumeration via calendar
0048329: Anonymous user enumeration via Search
0048359: Close RCE in ImageMap Question by Removing Unnecessary Code
0048362: Broken access control in MyStaff
0048365: Fix file deletion through uncaught file traversal opportunity in SingleChoice, MultipleChoice, KPrim, Matching, and Ordering Questions
0048366: Stored XSS in SCORM tracking reports
0048373: Protect Additional Function Commands By Write
0048374: Add Access Checks and Filtering to Result-Functions for Administrators
0048402: Prevent Accessing Anonymous Test Run by Providing Active Id Only
0048413: RCE via questionpool import
0048414: RCE in ImageMapQuestion
0048447: Anonymous user enumeration via Survey
0048453: File: Anonymous users could download file objects without permission when the public area was enabled.
Following 16 security issues have been resolved:
0047077: File Services: Prohibited file suffixes bypassable
0048028: Authenticated RCE via Test import
0048072: Authenticated RCE via CmiXapi
0048213: Stored XSS in the news
0048292: Unauthenticated test-question rendering
0048298: Fix forum attachment download processes ignored forum binding
0048313: Unauthenticated user and role enumeration via calendar
0048359: Close RCE in ImageMap Question by Removing Unnecessary Code
0048362: Broken access control in MyStaff
0048365: Fix file deletion through uncaught file traversal opportunity in SingleChoice, MultipleChoice, KPrim, Matching, and Ordering Questions
0048366: Stored XSS in SCORM tracking reports
0048402: Prevent Accessing Anonymous Test Run by Providing Active Id Only
0048413: RCE via questionpool import
0048414: RCE in ImageMapQuestion
0048447: Anonymous user enumeration via Survey
0048453: File: Anonymous users could download file objects without permission when the public area was enabled.
September 2026
Following 7 security issues have been resolved:
0046342: Membership: Potential unauthenticated access by anonymous
0047936: Learning Progress: Unauthenticated access to general course information
0048220: Learning Sequence: Missing RBAC check in learning sequence
0048241: User Service: Remove SYSTEM_ROLE from List of Assignable Roles in Local User Administration
0048260: Group: Missing permission checks in groups
0048264: SCORM 1.2: Missing authorisation in ilObjSAHSLearningModuleGUI for uploads in SCORM
0048265: File: Unauthorized Upload of Files
Following 6 security issues have been resolved:
0046342: Membership: Potential unauthenticated access by anonymous
0047936: Learning Progress: Unauthenticated access to general course information
0048220: Learning Sequence: Missing RBAC check in learning sequence
0048260: Group: Missing permission checks in groups
0048264: SCORM 1.2: Missing authorisation in ilObjSAHSLearningModuleGUI for uploads in SCORM
0048265: File: Unauthorized Upload of Files