CVE-2020-36944

Published January 28th, 2026

View on NVD ↗

CVSS v3

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF.

ILIAS-eLearning/ILIAS

GitHub repository for official ILIAS release branches and development branches (trunk)

GitHub

485