CVE-2026-82538: ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-30
Weakness: CWE-89

Description

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

Affected products

ILIAS-eLearning e.V. ILIAS: from 9.0 before 9.22; from 10.0 before 10.10; from 11.0 before 11.3 — fixed in 10.10, 11.3, 9.22

How to fix

Upgrade to a fixed version: ILIAS-eLearning e.V. ILIAS 10.10, 11.3, 9.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-82538 or the next vulnerability affects your stack