CVE-2026-82877: ILIAS Path Traversal Vulnerability

CVE-2026-82877 Overview

CVE-2026-82877 is an arbitrary file read vulnerability in the ILIAS learning management system. The flaw resides in the SOAP addFile method and affects ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2. Authenticated users can submit crafted XML with COPY-mode imports to the ilFileXMLParser component. Because the import directory is unsandboxed, attackers can supply absolute file paths and read arbitrary files readable by the web server user. Sensitive assets such as ILIAS configuration files containing database credentials and setup passwords can be exfiltrated. The issue is tracked as a path traversal weakness [CWE-22].

Critical Impact
Any authenticated ILIAS user can read arbitrary files as www-data, including configuration files that expose database credentials and setup passwords.

Affected Products

ILIAS versions prior to 9.22
ILIAS versions 10.0 through 10.9
ILIAS versions 11.0 through 11.2

Discovery Timeline

2026-08-31 - CVE-2026-82877 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82877

Vulnerability Analysis

The vulnerability sits in components/ILIAS/File/classes/class.ilFileXMLParser.php around line 244. When the parser processes an XML import in CONTENT_COPY mode, it constructs a temporary filename by concatenating the import directory with attacker-controlled character data. The SOAP endpoint ilSoapFileAdministration::addFile invokes this parser without enforcing that an import directory has been configured. When getImportDirectory() returns null or an empty string, the concatenation collapses to a path controlled entirely by the attacker. The server later reads this path and treats its contents as the file to be imported, returning file bytes back through the SOAP response.

Root Cause

The root cause is a missing sandbox check on the import directory combined with lack of path normalization. COPY mode was designed to operate only inside a trusted zip import context. The parser did not validate that the resolved path stayed within the import directory, allowing absolute paths and .. traversal sequences to escape any intended base directory.

Attack Vector

Exploitation requires network access to the ILIAS SOAP interface and valid low-privilege credentials. The attacker submits a crafted XML payload to addFile with mode="COPY" and an absolute file path such as /var/www/ilias/data/client.ini.php in the CDATA content. The server reads the referenced file as www-data and returns its contents. Sensitive targets include ILIAS client.ini.php, /etc/passwd, and any application secret readable by the PHP process.

php

// Security patch applied in commit e9acd3f8
// components/ILIAS/File/classes/class.ilFileXMLParser.php
$baseDecodedFilename = ilFileUtils::ilTempnam();
if ($this->mode === ilFileXMLParser::$CONTENT_COPY) {
    // SECURITY (ILIAS10-025): COPY mode is only valid inside a trusted
    // import/zip context where setImportDirectory() has been called.
    // A null import directory produces an absolute attacker-controlled
    // path -> arbitrary file read as www-data.
    $importDir = $this->getImportDirectory();
    if ($importDir === null || $importDir === '') {
        throw new ilFileException(
            'COPY mode requires a sandboxed import directory.',
            ilFileException::$ID_MISMATCH
        );
    }
    $rel      = self::normalizeRelativePath($this->cdata);
    $base     = realpath($importDir);
    $resolved = realpath($importDir . '/' . $rel);
    if ($base === false || $resolved === false
        || !str_starts_with($resolved, $base . DIRECTORY_SEPARATOR)) {
        throw new ilFileException(
            'COPY mode path must stay within the import directory.',
            ilFileException::$ID_MISMATCH
        );
    }
    $this->tmpFilename = $resolved;
}

Source: ILIAS Commit e9acd3f8

Detection Methods for CVE-2026-82877

Indicators of Compromise

SOAP requests to addFile containing XML with mode="COPY" and CDATA values starting with / or containing .. sequences.
Web server access logs showing authenticated POST requests to /webservice/soap/server.php from unusual client IPs.
Outbound responses containing recognizable ILIAS configuration strings such as client.ini.php or database DSN fragments.
Unexpected file reads by the www-data user targeting /etc/passwd, client.ini.php, or key material.

Detection Strategies

Inspect SOAP request bodies for <Content ... mode="COPY"> elements containing absolute paths or traversal sequences.
Correlate low-privilege authentication events with SOAP addFile invocations that reference paths outside expected import directories.
Alert on any ilFileException entries in application logs referencing ID_MISMATCH after patch deployment.

Monitoring Recommendations

Enable verbose logging on the ILIAS SOAP endpoint and forward logs to a central analytics platform.
Baseline normal addFile usage patterns, including size, source accounts, and import directory paths.
Monitor filesystem access by the PHP-FPM or Apache worker process for reads outside the ILIAS web root and data directory.

How to Mitigate CVE-2026-82877

Immediate Actions Required

Upgrade ILIAS to version 9.22, 10.10, or 11.3 or later, which contain the fix from commit e9acd3f8.
Rotate ILIAS database credentials and setup passwords in case configuration files were previously exfiltrated.
Review SOAP access logs for prior exploitation attempts referencing addFile with COPY-mode payloads.
Restrict SOAP interface access to trusted networks where feasible.

Patch Information

The ILIAS maintainers released patch commit e9acd3f8d498279f6c26a145ca32ce85152496a4 which confines the ilFileXMLParser COPY-mode path to the import directory. The patch rejects requests when getImportDirectory() returns null or an empty string, resolves paths with realpath, and enforces that the resolved path begins with the import directory base. See the VulnCheck ILIAS File Read Advisory and the ILIAS XML Parser Code for reference.

Workarounds

Disable the ILIAS SOAP interface if it is not required by production integrations.
Restrict access to /webservice/soap/server.php at the reverse proxy or web application firewall layer.
Revoke SOAP privileges from low-trust user roles until the patch is deployed.
Constrain file system permissions so the PHP worker user cannot read secrets outside the ILIAS data directory.

bash

# Example nginx snippet restricting SOAP access to a trusted management CIDR
location ^~ /webservice/soap/ {
    allow 10.0.0.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}