CVE-2023-32778
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.
Scoring
- Severity
- LOW
- CVSS base score
- 3.3
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
- EPSS probability
- 0.22%
- CWE
- CWE-23
- Published
- 2026-09-14
- Last modified
- 2026-09-16
Affected products
- ILIAS ILIAS
- ILIAS ILIAS
- ILIAS ILIAS
Weakness type
Related vulnerabilities
- CVE-2025-64446 — A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
- CVE-2025-55752 — Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2025-52207 — PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
- CVE-2026-33494 — Ory Oathkeeper has a path traversal authorization bypass
- CVE-2025-62878 — Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
- CVE-2025-3365 — Relative Path Traversal in OnlineSuite
- CVE-2025-47445 — WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability