Security-Blog

Die Security-Gruppe informiert über behobene Sicherheitslücken in ILIAS

December 2025

ILIAS 10.4

Tokar, David [tokard], Wolf, Fabian [fwolf] - 16. Dec 2025, 16:30

Following 8 security issues have been resolved:

0046023: SOAP: Unauthorized function calls
0046024: SOAP: Unauthorized data exposure
0046025: SOAP: Missing source permission check
0046496: ilServer: Apache Tika multiple XXE vulnerabilities
0045883: BackgroundTasks: Missind CSRF token for two commands in ilBTControllerGUI
0045884: BackgroundTasks: Open redirect in ilBTControllerGUI
0045900: BackgroundTasks: Unauthorized deletion of tasks
0045905: Repository: Stored XSS via SVG file upload of custom icons

More…
· Link

ILIAS 9.16

Tokar, David [tokard], Wolf, Fabian [fwolf] - 16. Dec 2025, 16:15

Following 8 security issues have been resolved:

0046023: SOAP: Unauthorized function calls
0046024: SOAP: Unauthorized data exposure
0046025: SOAP: Missing source permission check
0046496: ilServer: Apache Tika multiple XXE vulnerabilities
0045883: BackgroundTasks: Missind CSRF token for two commands in ilBTControllerGUI
0045884: BackgroundTasks: Open redirect in ilBTControllerGUI
0045900: BackgroundTasks: Unauthorized deletion of tasks
0045905: Repository: Stored XSS via SVG file upload of custom icons

More…
· Link

ILIAS 8.26

Tokar, David [tokard], Wolf, Fabian [fwolf] - 16. Dec 2025, 16:00

Following 4 security issues have been resolved:

0045883: BackgroundTasks: Missind CSRF token for two commands in ilBTControllerGUI
0045884: BackgroundTasks: Open redirect in ilBTControllerGUI
0045900: BackgroundTasks: Unauthorized deletion of tasks
0045905: Repository: Stored XSS via SVG file upload of custom icons

More…
· Link

November 2025

ILIAS 10.3

Tokar, David [tokard], Wolf, Fabian [fwolf] - 4. Nov 2025, 17:00

Following 6 security issues have been resolved:

0045738: Unauthenticated Remote Code Execution
0045898: Wiki: Unauthorized Access to LTI Settings
0045899: ilUIPluginRouterGUI: Unauthorized function calls
0045910: fix: Verification of LTI Result Service Calls
0045897: MediaPool: Open/Unvalidated Redirect
0045975: SOAP: Unauthorized function calls


More…
· Link

ILIAS 9.15

Tokar, David [tokard], Wolf, Fabian [fwolf] - 4. Nov 2025, 16:45

Following 6 security issues have been resolved:

0045738: Unauthenticated Remote Code Execution
0045898: Wiki: Unauthorized Access to LTI Settings
0045899: ilUIPluginRouterGUI: Unauthorized function calls
0045938: Query UI: Known vulnerability in version 1.13.1 (XSS)
0045897: MediaPool: Open/Unvalidated Redirect
0045975: SOAP: Unauthorized function calls

More…
· Link