CVE-2020-23995: Ilias

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.

Affected products

• Ilias Ilias: before 5.3.19 (fixed in 5.3.19); from 5.4.0, before 5.4.12 (fixed in 5.4.12)

Published 2021-05-13. Last modified 2026-06-17.