An authenticated user can retrieve arbitrary files from the server by sending a specially crafted XML payload to the SOAP addFile method. The vulnerability is caused by the service accepting unsandboxed COPY-mode imports, allowing the attacker to specify absolute file paths. This enables reading sensitive files such as configuration files that contain database credentials and setup passwords, thereby exposing confidential data and potentially facilitating further compromise.

The flaw affects ILIAS eLearning e.V. products running any version prior to 9.22, versions 10.0 through 10.9, and 11.0 through 11.2. The vulnerability exists in the SOAP component responsible for file administration. Users of these versions must consider their deployments vulnerable until a patched release is applied.

The CVSS score of 7.1 indicates serious potential for data disclosure with moderate exploitation effort. The EPSS score is not reported, but the lack of listed exploitation in the KEV catalog suggests no widespread active exploitation yet. Still, because the flaw only requires authentication and no privilege escalation, any user with access to the SOAP service can abuse it. The path to exploitation is a simple SOAP request, which can be performed from an authenticated session within the application, requiring minimal setup.