PatchTheCVEilias vulnerabilities and fixes
Recent CVEs affecting ilias, with upgrade or downgrade steps. 8 tracked.
ilias has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-01-28. Highest priority: CVE-2024-33529 (score 45/100).
- CVE-2025-11344 MEDIUM 6.3 DOWNGRADE A vulnerability was detected in ILIAS up to 8.23/9.13/10.1
- CVE-2025-11346 MEDIUM 6.3 DOWNGRADE A vulnerability has been found in ILIAS up to 8.23/9.13/10.1
- CVE-2025-11345 MEDIUM 5.5 DOWNGRADE A flaw has been found in ILIAS up to 8.23/9.13/10.1
- CVE-2024-33529 HIGH 7.2 UPGRADE ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with adm
- CVE-2024-33528 MEDIUM 4.7 UPGRADE A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote
- CVE-2024-33527 MEDIUM 5.4 UPGRADE A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in I
- CVE-2024-33526 HIGH 7.1 UPGRADE A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature
- CVE-2020-36944 MEDIUM 4.0 UPGRADE ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attacker
FAQ
How do I fix ilias vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ilias being exploited right now?
None of the tracked ilias CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ilias CVE should I patch first?
CVE-2024-33529 currently ranks highest (45/100): ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with adm.