CVE-2026-85135: ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ILIAS MediaPool ZipAdapter.php (Services/Repository/Service/Resources/ZipAdapter.php) - ilObjMediaObjectGUI::uploadMultipleSubtitleFileObjectto a version that resolves this vulnerability.Fixed in 9.22 - Upgrade
Upgrade
ILIAS MediaPool ZipAdapter.php (Services/Repository/Service/Resources/ZipAdapter.php) - ilObjMediaObjectGUI::uploadMultipleSubtitleFileObjectto a version that resolves this vulnerability.Fixed in 10.10 - Upgrade
Upgrade
ILIAS MediaPool ZipAdapter.php (Services/Repository/Service/Resources/ZipAdapter.php) - ilObjMediaObjectGUI::uploadMultipleSubtitleFileObjectto a version that resolves this vulnerability.Fixed in 11.3 - Upgrade
Upgrade
ILIAS MediaPool ZipAdapter.php (Services/Repository/Service/Resources/ZipAdapter.php) - ilObjMediaObjectGUI::uploadMultipleSubtitleFileObjectto a version that resolves this vulnerability.Patch ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23
Event History
Frequently Asked Questions
Which ILIAS versions need remediation?
The issue affects ILIAS versions through 9.21, 10.9, and 11.2. Upgrade to 9.22, 10.10, or 11.3, respectively, to mitigate it.
What level of access does an attacker need?
The vulnerability can be exploited remotely, but the supplied severity vector indicates that the attacker requires low privileges. No user interaction is required.
What is the potential impact of successful exploitation?
Successful exploitation enables unrestricted file upload in the MediaPool component. The reported vector rates confidentiality, integrity, and availability impact as low.
What can identify the relevant fix?
The patches are identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4 and b0d61be43671b6bfe91baf469a5ee11e764f2e23.