CVE-2026-82538: ILIAS Learning Management System SQLi Flaw

CVE-2026-82538 Overview

CVE-2026-82538 is a SQL injection vulnerability in ILIAS, an open-source learning management system. The flaw exists in the repository trash table, where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users holding write permission on any container can inject arbitrary SQL through the sort parameter. Because multi-statement execution is enabled in the database layer, stacked queries allow full database read and write access, including administrator account takeover. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers with container write permission can execute stacked SQL queries, achieving full database read/write and administrator takeover of the ILIAS instance.

Affected Products

ILIAS versions prior to 9.22
ILIAS 10.x versions prior to 10.10
ILIAS 11.x versions prior to 11.3

Discovery Timeline

2026-09-04 - CVE-2026-82538 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82538

Vulnerability Analysis

The vulnerability resides in the repository trash table component of ILIAS. Table navigation controls submit a sort field parameter through HTTP requests to reorder listed items. The application concatenates the received value into the ORDER BY clause of a backend SQL query. No allowlist check is performed to confirm the parameter matches a declared sortable column.

An authenticated user with write permission on any container in the repository can reach this code path. The user issues a crafted request that supplies attacker-controlled SQL syntax where a column name is expected. The database layer used by ILIAS has multi-statement execution enabled, so a terminator followed by additional statements is executed as stacked queries. This turns a read-only ordering injection into a full read and write primitive.

Root Cause

The root cause is missing input validation in the sort parameter handler. Sort fields for ORDER BY clauses cannot be safely parameterized in most SQL dialects and must be validated against an explicit allowlist of column names. The affected releases skipped this check and treated user-controlled input as trusted SQL identifiers. Combined with multi-statement execution at the database driver level, the flaw exposes the entire database schema to modification.

Attack Vector

Exploitation is remote and requires an authenticated ILIAS session with write permission on any container. The attacker sends an HTTP request to the repository trash table endpoint that includes a malicious sort parameter. The payload closes the intended ORDER BY expression, appends a stacked statement such as an UPDATE against the usr_data table, and elevates an attacker-controlled account to administrator. Post-exploitation, the attacker can read arbitrary tables, exfiltrate credentials, and pivot to any functionality that requires administrator privileges. See the VulnCheck Advisory: ILIAS SQL Injection for additional technical detail.

Detection Methods for CVE-2026-82538

Indicators of Compromise

HTTP requests to ILIAS repository trash table endpoints containing SQL keywords (SELECT, UPDATE, INSERT, UNION, --, ;) in the sort parameter.
Unexpected privilege changes in the usr_data table, particularly new users granted the root role or existing accounts modified to hold administrator rights.
Anomalous database error entries in ILIAS or PHP logs referencing malformed ORDER BY clauses.
Sessions from low-privilege accounts issuing repeated navigation requests to trash table views with atypical query string content.

Detection Strategies

Deploy WAF rules that inspect requests to ILIAS repository endpoints for stacked-query patterns, statement terminators, and SQL metacharacters in the sort parameter.
Enable database query logging and alert on multi-statement queries originating from the ILIAS application user.
Correlate authentication events with subsequent role or permission changes to detect account takeover flowing from container-write users to administrators.

Monitoring Recommendations

Audit the usr_data and role assignment tables on a scheduled basis and compare against a known-good baseline.
Monitor outbound traffic from the ILIAS host for signs of data exfiltration following suspicious repository requests.
Ingest ILIAS application logs, web server access logs, and database audit logs into a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-82538

Immediate Actions Required

Upgrade ILIAS to version 9.22, 10.10, or 11.3, matching the release branch currently deployed.
Review all accounts with write permission on any repository container and revoke unnecessary access.
Rotate administrator credentials and API tokens after patching to invalidate any that may have been compromised.
Audit recent changes to user roles and repository permissions to identify potential post-exploitation activity.

Patch Information

The ILIAS project has released fixed builds in versions 9.22, 10.10, and 11.3. The corrective change validates the sort parameter against the set of declared sortable columns before it is placed into the ORDER BY clause. Refer to the official ILIAS Presentation Documentation #225630 and the ILIAS Blog Post Preview #934 for release notes and upgrade instructions.

Workarounds

Disable multi-statement execution in the database driver configuration to prevent stacked queries from executing, reducing impact from ordering injection to a data-read primitive only.
Restrict container write permissions to trusted operators until the patch is deployed.
Place the ILIAS application behind a web application firewall with rules that reject SQL metacharacters in the sort parameter.

bash

# Configuration example: disable MySQL multi-statement execution in PHP
# In php.ini or application bootstrap, ensure PDO is initialized without
# the multi-statement flag:
#
#   $pdo = new PDO($dsn, $user, $pass, [
#       PDO::MYSQL_ATTR_MULTI_STATEMENTS => false,
#   ]);
#
# For mysqli, avoid mysqli_multi_query() and use prepared statements only.