Security
The code of ILIAS is open-source and can be reviewed by any interested party. If you might have encountered a security issue, please report it in confidence to our security mailing list: security@ilias.de
How should I report a security issue?
For obvious reasons, security issues must be treated confidentially. This is the only way to ensure the security of ILIAS installations as far as possible until the problem has been resolved.For this reason, there is a process in place for reporting such issues.
Important: Do NOT create an entry in Mantis!
- Write an email to security@ilias.de about your discovery, containing a description of the issue with the scenario in which the problem is triggered and a description of its implications. Please provide all necessary steps to reproduce the issue. We kindly ask you to withhold full disclosure of the issue until a fix is ready and the new release has been build and made available to everyone (full disclosure about 1 week after the new release is published).
- The Security Group will assign an issue manager. He/She will look into the issue and try and reproduce the problem.
- The issue manager will contact you on behalf of the ILIAS open source e-Learning e.V. by email. We are grateful for any further help/information you can provide during the analysis and bugfixing process.
- Depending on the severity and impact of the issue at hand, the developers will build a new release ASAP or continue with the default roadmap.
- Optional: We are very interested in giving proper credit for your finding and your support for the project. If you want to, we can include your name and/or institution in our release notes. We will not publish your name or the name of your institution without your consent.
Where should I publish my fix of a security issue?
We are delighted when solutions are offered together with the initial report. Please follow the official process in our security.md in order to not unnecessarily endanger existing ILIAS installations. If you don't have access to the corresponding issue in our internal security tracker please give access to your patch files to the issue manager through a secure channel.
How do I receive security update notifications?
Our Security Group has set up a blog where we regularly post updates on important security issues. Subscribe to this blog by clicking the bell icon in the top right-hand corner to stay up to date.
Blogs
Which versions receive security fixes?
Bug fixes are always provided for the currently supported versions of ILIAS. When a version of ILIAS runs out of maintenance, it still receives security fixes for a further year.
You can see which versions are currently supported in Downloads & Releases.