CVE-2023-32778: ILIAS Learning Management System RCE Vulnerability

CVE-2023-32778 Overview

CVE-2023-32778 is a path traversal vulnerability [CWE-23] affecting the ILIAS open-source learning management system. The flaw allows an authenticated attacker to execute arbitrary code by uploading a crafted ZIP archive. Affected versions include ILIAS 6.23, ILIAS 7 releases prior to 7.22, and ILIAS 8.1. The issue stems from insufficient validation of file paths during ZIP extraction, enabling files to be written outside the intended target directory.

Critical Impact
Authenticated users with elevated privileges can achieve arbitrary code execution on the ILIAS server by abusing ZIP upload functionality.

Affected Products

ILIAS 6.23
ILIAS 7 versions before 7.22
ILIAS 8.1

Discovery Timeline

2026-09-14 - CVE-2023-32778 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2023-32778

Vulnerability Analysis

The vulnerability is classified as Relative Path Traversal [CWE-23]. ILIAS accepts ZIP archives through its upload interfaces and extracts their contents to server-side directories. The extraction routine does not adequately sanitize entry names inside the archive. An attacker who crafts entries containing ../ sequences can direct the extractor to write files to arbitrary filesystem locations. Writing an executable script such as a PHP file into a web-accessible directory yields arbitrary code execution under the web server user.

Root Cause

The underlying defect is missing normalization and validation of archive entry paths before file creation. Secure ZIP handling requires resolving each entry against the intended extraction root and rejecting any path that escapes that root. ILIAS releases prior to the fixed versions did not enforce this check consistently across upload handlers that process ZIP archives.

Attack Vector

Exploitation requires network access to the ILIAS instance and an authenticated account with high privileges, such as an administrator or a user permitted to import content. The attacker uploads a ZIP archive whose entries contain traversal sequences. Upon extraction, the malicious payload lands in a directory reachable by the web server. Subsequent HTTP requests trigger execution of the planted code. Refer to the ILIAS Security Issues Document for vendor-provided technical details.

No verified public exploit code is available for CVE-2023-32778.
See the ILIAS security advisory for vendor-provided technical detail.

Detection Methods for CVE-2023-32778

Indicators of Compromise

Unexpected .php, .phtml, or other executable script files appearing in ILIAS content, data, or web-root directories following a ZIP import.
ZIP archive entries containing ../ sequences or absolute paths observed in upload logs or on-disk archives.
New or modified files owned by the web server user in directories that normally receive only static learning content.

Detection Strategies

Monitor ILIAS upload endpoints for POST requests carrying ZIP payloads from privileged accounts and correlate with subsequent script file creation.
Perform integrity checks on the ILIAS web root and data directories using file hashes and alert on unexpected additions of executable content.
Review PHP-FPM or web server access logs for requests to newly created script files immediately after an import operation.

Monitoring Recommendations

Enable audit logging for content import and file upload actions performed by administrative and editor accounts.
Forward web server, PHP error, and ILIAS application logs to a centralized log platform for correlation and retention.
Alert on anomalous privilege usage, such as content imports occurring outside of business hours or from unusual source addresses.

How to Mitigate CVE-2023-32778

Immediate Actions Required

Upgrade ILIAS to a fixed release: 7.22 or later for the 7.x branch, or a version newer than 8.1 for the 8.x branch. ILIAS 6.23 users should migrate to a supported branch.
Audit administrator and editor accounts and remove upload or import privileges from accounts that do not require them.
Inspect the ILIAS web root and data directories for unauthorized script files and remove any artifacts introduced through ZIP imports.

Patch Information

ILIAS addressed the issue in versions after 7.22 for the 7.x branch and in releases following 8.1. Consult the ILIAS Security Issues Document and the ILIAS Documentation Page for upgrade guidance and release notes.

Workarounds

Restrict access to ILIAS import and upload interfaces at the web server or reverse proxy layer until the patch is applied.
Configure the web server to deny execution of PHP files inside ILIAS data and upload directories.
Require multi-factor authentication for administrative ILIAS accounts to raise the cost of credential-based access.

bash

# Example nginx configuration to block PHP execution in ILIAS data paths
location ~* ^/data/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}