CVE-2026-85135

The record

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.

Affected packages

Related vulnerabilities

• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284
• CVE-2026-83395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284
• CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-284
• CVE-2026-106580 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-284
• CVE-2026-61700 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-284
• CVE-2026-86812 The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of… CWE-284
• CVE-2026-85545 There is an Vulnerability in some HikCentral Access Control versions. CWE-284
• CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in… CWE-284