CVE-2026-82538 ILIAS-eLearning e.V. CVE debrief

Who should care

Defenders and administrators of ILIAS deployments using versions before 9.22, 10.10, and 11.3 should assess exposure and verify remediation. User accounts with write permissions are at risk and should be restricted or monitored closely.

Why it matters

CVE-2026-82538 is a high-severity SQL injection vulnerability in ILIAS that allows authenticated users with write permission to inject arbitrary SQL, potentially enabling full database access and administrator account takeover. Defenders and administrators of affected ILIAS deployments should assess exposure, verify remediation, and restrict user accounts with write permissions.

• Potential full database read and write access for authenticated users with write permission
• Possible administrator account takeover through stacked queries
• Required verification of ILIAS versions and user account permissions
• Need for input validation and sanitization to prevent SQL injection

Technical summary

The ILIAS repository trash table is vulnerable to SQL injection. The table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL, potentially enabling full database read and write access as well as administrator account takeover. This vulnerability affects ILIAS versions before 9.22, 10.10, and 11.3, and defenders should assess exposure and verify remediation for user accounts with write permissions.

Defensive priority

High priority for systems using ILIAS versions before 9.22, 10.10, and 11.3. Assess exposure and verify remediation for user accounts with write permissions.

Recommended defensive actions

• Assess exposure for ILIAS deployments using versions before 9.22, 10.10, and 11.3
• Verify user accounts with write permissions and restrict as necessary
• Implement input validation and sanitization for the sort parameter
• Monitor for suspicious database activity and potential administrator account takeovers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in ILIAS. Vendor documentation and additional references are available for affected versions and potential impacts. The vulnerability allows authenticated users with write permission to inject arbitrary SQL, potentially enabling full database read and write access as well as administrator account takeover. Defenders should verify ILIAS versions and user account permissions, and implement input validation and sanitization to prevent SQL injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.