Medium severity · published Sep 3, 2026
CVE-2026-85135
ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IL
ILIAS · Ilias
9.0; 9.1; 9.2; 9.3; 9.4; 9.5; +29 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85135
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85135
github.com
https://github.com/ILIAS-eLearning/ILIAS/commit/b0d61be43671b6bfe91baf469a5ee11e764f2e23
github.com
https://github.com/ILIAS-eLearning/ILIAS/releases/tag/v11.3
vuldb.com
https://vuldb.com/cve/CVE-2026-85135
vuldb.com
https://vuldb.com/submit/892842
vuldb.com
https://vuldb.com/vuln/398335
vuldb.com
https://vuldb.com/vuln/398335/cti
More from ILIAS
9.8
CVE-2025-11346
ILIAS Base64 Decoding unserialize deserialization
9.8
CVE-2025-11345
ILIAS Test Import unserialize deserialization
9.8
CVE-2025-11344
ILIAS Certificate Import code injection
9.8
CVE-2023-36487
The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account
9.0
CVE-2023-45869
ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload