ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

Summary

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

Timeline

1. Sep 4, 2026, 5:37 PM UTCCVE published
2. Sep 14, 2026, 7:21 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 30, 2026, 4:38 PM UTCRecord last updated

Affected versions

• ILIAS-eLearning e.V. ILIAS

  From 9.0 · fixed in 9.22; From 10.0 · fixed in 10.10; From 11.0 · fixed in 11.3

References 8