Security-Blog

ILIAS 10.4

Tue, 16 Dec 2025 16:30:00 +0100

Following 8 security issues have been resolved:

0046023: SOAP: Unauthorized function calls
0046024: SOAP: Unauthorized data exposure
0046025: SOAP: Missing source permission check
0046496: ilServer: Apache Tika multiple XXE vulnerabilities
0045883: BackgroundTasks: Missind CSRF token for two commands in ilBTControllerGUI
0045884: BackgroundTasks: Open redirect in ilBTControllerGUI
0045900: BackgroundTasks: Unauthorized deletion of tasks
0045905: Repository: Stored XSS via SVG file upload of custom icons

ILIAS 9.16

Tue, 16 Dec 2025 16:15:00 +0100

ILIAS 8.26

Tue, 16 Dec 2025 16:00:59 +0100

Following 4 security issues have been resolved:

0045883: BackgroundTasks: Missind CSRF token for two commands in ilBTControllerGUI
0045884: BackgroundTasks: Open redirect in ilBTControllerGUI
0045900: BackgroundTasks: Unauthorized deletion of tasks
0045905: Repository: Stored XSS via SVG file upload of custom icons

ILIAS 10.3

Tue, 04 Nov 2025 17:00:00 +0100

Following 6 security issues have been resolved:

0045738: Unauthenticated Remote Code Execution
0045898: Wiki: Unauthorized Access to LTI Settings
0045899: ilUIPluginRouterGUI: Unauthorized function calls
0045910: fix: Verification of LTI Result Service Calls
0045897: MediaPool: Open/Unvalidated Redirect
0045975: SOAP: Unauthorized function calls

ILIAS 9.15

Tue, 04 Nov 2025 16:45:00 +0100

Following 6 security issues have been resolved:

0045738: Unauthenticated Remote Code Execution
0045898: Wiki: Unauthorized Access to LTI Settings
0045899: ilUIPluginRouterGUI: Unauthorized function calls
0045938: Query UI: Known vulnerability in version 1.13.1 (XSS)
0045897: MediaPool: Open/Unvalidated Redirect
0045975: SOAP: Unauthorized function calls

ILIAS 8.25

Tue, 04 Nov 2025 16:30:00 +0100

Following 4 security issues have been resolved:

0045738: Unauthenticated Remote Code Execution
0045898: Wiki: Unauthorized Access to LTI Settings
0045899: ilUIPluginRouterGUI: Unauthorized function calls
0045897: MediaPool: Open/Unvalidated Redirect

ILIAS 10.2

Tue, 23 Sep 2025 16:05:00 +0200

Following 9 security issues have been resolved:

0045633: Test & Assessment: Stored XSS in Question Pool
0045635: WOPI: Open Redirect
0045738: Certificate: Unauthenticated Remote Code Execution
0045744: Test & Assessment: Unsafe operation during import
0045745: Certificate: Unsanitized SVG Files in Import
0045752: Test & Assessment: Authenticated RCE über unsichere Deserialisierung
0045776: Rating: Missing CSRF Token in Rating request
0045777: Data Collection: Open/Unvalidated Redirect in DataCollections
0045801: Test & Assessment: Fixes Wrong Access Right Check and Route From Test to Question

ILIAS 9.14

Tue, 23 Sep 2025 16:00:00 +0200

ILIAS 8.24

Tue, 23 Sep 2025 15:55:00 +0200

Following 7 security issues have been resolved:

0045633: Test & Assessment: Stored XSS in Question Pool
0045738: Certificate: Unauthenticated Remote Code Execution
0045744: Test & Assessment: Unsafe operation during import
0045745: Certificate: Unsanitized SVG Files in Import
0045752: Test & Assessment: Authenticated RCE über unsichere Deserialisierung
0045776: Rating: Missing CSRF Token in Rating request
0045801: Test & Assessment: Fixes Wrong Access Right Check and Route From Test to Question

ILIAS 10.1

Tue, 26 Aug 2025 16:14:49 +0200

Following 2 security issues have been resolved:

0045628: [UICore] UICore: Improper validation of CSRF tokens
0045642: [Logging] Logging: Plaintext Passwords in Error Logs

ILIAS 9.13

Tue, 26 Aug 2025 16:09:07 +0200

Following 2 security issues have been resolved:

0045628: [UICore] UICore: Improper validation of CSRF tokens
0045642: [Logging] Logging: Plaintext Passwords in Error Logs

ILIAS 8.23

Tue, 26 Aug 2025 16:00:50 +0200

Following 2 security issues have been resolved:

0045628: [UICore] UICore: Improper validation of CSRF tokens
0045642: [Logging] Logging: Plaintext Passwords in Error Logs

ILIAS 9.12

Tue, 15 Jul 2025 16:00:00 +0200

No security issues have been resolved in this version.

ILIAS 8.22

Tue, 08 Jul 2025 15:30:00 +0200

Following 5 security issues have been resolved:

0044299: [Weblink] Weblink: Missing permission checks
0044435: [Exercise] Exercise: Unauthorized access
0044469: [Glossary] Glossary: Missing RBAC checks
0044536: [Session (Course & Group)] Session: Missing RBAC checks
0045164: [Media Pools and Media Objects] Media Pool: DoS through infinite loop

ILIAS 9.11

Tue, 08 Jul 2025 15:30:00 +0200

ILIAS 9.10

Tue, 27 May 2025 17:00:00 +0200

Following 3 security issues have been resolved:

0044343: MediaCast: Unauthorized access
0044426: Learning Module HTML: Unauthorized access
0044559: MediaCast: Missing RBAC checks

ILIAS 8.21

Tue, 27 May 2025 17:00:00 +0200

Following 2 security issues have been resolved:

0044343: MediaCast: Unauthorized access
0044559: MediaCast: Missing RBAC checks

ILIAS 8.20

Thu, 22 May 2025 17:00:00 +0200

Following security issue has been resolved:

0044426: Learning Module HTML: Unauthorized access to settings form

ILIAS 9.9

Tue, 20 May 2025 17:00:00 +0200

Due to unfortunate circumstances, there is no security fix in ILIAS 9.9.
Please update to ILIAS 9.10 immediately.

Following security issue has been resolved:

0044426: Learning Module HTML: Unauthorized access to settings form

ILIAS 8.19

Tue, 01 Apr 2025 17:00:00 +0200

Following 8 security issues have been resolved:

0040995: Fixed escaping of Title and Author in Tile-View of Objects
0044199: XSS hidden input escaping
0044254: ActiveRecord: Missing escaping
0044255: Bibliographic: Missing input validation
0044342: LearningSequence: Unauthorized access
0044438: Test: Missing RBAC checks
0044441: XSS in Question Titles
0044737: Added Missing RBAC Check in TranslationsGUI

ILIAS 9.8

Tue, 01 Apr 2025 17:00:00 +0200

Following 10 security issues have been resolved:

0040995: Fixed escaping of Title and Author in Tile-View of Objects
0043900: Fixed escaping of LOM on the info tab and in the editor
0044126: Login Response Improvement: Use generic error message
0044199: XSS hidden input escaping
0044254: ActiveRecord: Missing escaping
0044255: Bibliographic: Missing input validation
0044342: LearningSequence: Unauthorized access
0044438: Test: Missing RBAC checks
0044441: XSS in Question Titles
0044737: Added Missing RBAC Check in TranslationsGUI