PT-2026-5151 · Ilias.De+2 · Ilias Learning Management System+1

Dot/Kx1Z0 · Published 2026-01-28 · Updated 2026-02-09 · CVE-2020-36944

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ILIAS Learning Management System version 4.3

Description The ILIAS Learning Management System contains a server-side request forgery issue. This allows attackers to read local files through the portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when a portfolio is exported to PDF. The vulnerable functionality involves the use of XMLHttpRequest to access local files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-36944

Affected Products

Ilias Learning Management System

Ilias

References · 7

• 🔥 https://exploit-db.com/exploits/49148 · Exploit
• https://osv.dev/vulnerability/CVE-2020-36944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36944 · Security Note
• https://github.com/ILIAS-eLearning/ILIAS · Note
• https://t.me/cveNotify/151454 · Telegram Post
• https://ilias.de · Note
• https://vulncheck.com/advisories/ilias-learning-management-system-ssrf · Note