An authenticated user can retrieve arbitrary files from the server by sending a specially crafted XML payload to the SOAP addFile method. The vulnerability is present in ILIAS before versions 9.22, 10.10, and 11.3 because the addFile service accepts unsandboxed COPY-mode imports, allowing the attacker to specify absolute file paths. This allows the reading of sensitive configuration files that contain database credentials and setup passwords, exposing confidential data and potentially enabling further compromise.

The flaw affects ILIAS eLearning e.V. products running any version earlier than 9.22, any version before 10.10, and any version before 11.3. The vulnerability exists in the SOAP component responsible for file administration. Users of these versions should consider their deployments vulnerable until a patched release is applied.

The CVSS score of 7.1 indicates serious potential for data disclosure with moderate exploitation effort. The EPSS score is < 1%, indicating a low probability of exploitation, and the lack of listing in KEV suggests no widespread active exploitation yet. Still, because the flaw only requires authentication and no privilege escalation, any user with access to the SOAP service can abuse it. The path to exploitation is a simple SOAP request, which can be performed from an authenticated session within the application, requiring minimal setup.