Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-86416

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 5 days ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks, 4 days ago

ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.

References

ILIAS 11.4 Security Advisory (Mantis 0048260) vendor-advisory
ILIAS 10.11 Security Advisory (Mantis 0048260) vendor-advisory
ILIAS 9.23 Security Advisory (Mantis 0048260) vendor-advisory
Group: add missing permission checks in GUI (48260) patch
ilObjGroupGUI::updateGroupTypeObject() at v11.3 technical-description
ilObjGroupGUI::saveMapSettingsObject() at v11.3 technical-description
https://github.com/ILIAS-eLearning/ILIAS product
VulnCheck Advisory: ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods third-party-advisory

Affected products

ILIAS

<11.4
<9.23
<10.11

Matching in nixpkgs

pkgs.biliass

Convert Bilibili XML/protobuf danmaku to ASS subtitle

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.5.0
nixos-26.05 2.3.1
- nixos-26.05-small 2.3.1
- nixpkgs-26.05-darwin 2.3.1

pkgs.python313Packages.biliass

Convert Bilibili XML/protobuf danmaku to ASS subtitle

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.5.0
nixos-26.05 2.3.1
- nixos-26.05-small 2.3.1
- nixpkgs-26.05-darwin 2.3.1

pkgs.python314Packages.biliass

Convert Bilibili XML/protobuf danmaku to ASS subtitle

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.5.0
nixos-26.05 2.3.1
- nixos-26.05-small 2.3.1
- nixpkgs-26.05-darwin 2.3.1

Package maintainers

@linsui linsui <linsui555@gmail.com>

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-85135

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 3 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 2 days ago
@LeSuisse dismissed (not in Nixpkgs) 3 weeks, 2 days ago

ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue. The patch is identified as ef5d7f99fe1ea0381db04b333a2906548b3590e4/b0d61be43671b6bfe91baf469a5ee11e764f2e23. It is recommended to upgrade the affected component.

References

VDB-398335 | ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload technical-descriptionvdb-entry
VDB-398335 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
CVE-2026-85135 | CVE Analysis and Report third-party-advisory
Submit #892842 | ILIAS open source e-Learning e.V. ILIAS 9/10/11/12 Code Injection third-party-advisory
https://github.com/ILIAS-eLearning/ILIAS/commit/b0d61be43671b6bfe91baf469a5ee11… patch
https://github.com/ILIAS-eLearning/ILIAS/releases/tag/v11.3 patch

Affected products

ILIAS

==10.4
==9.10
==11.2
==9.20
==10.1
==9.19
==9.18
==9.2
==9.9
==9.16
==9.17
==10.7
==9.13
==9.5
==11.1
==11.3
==9.7
==10.6
==9.6
==10.5
==10.8
==9.0
==9.8
==11.0
==9.12
==10.2
==10.3
==10.10
==10.9
==9.22
==9.21
==9.1
==9.14
==9.4
==9.3
==9.11
==9.15
==10.0

Matching in nixpkgs

pkgs.biliass

Convert Bilibili XML/protobuf danmaku to ASS subtitle

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.5.0
nixos-26.05 2.3.1
- nixos-26.05-small 2.3.1
- nixpkgs-26.05-darwin 2.3.1

pkgs.python313Packages.biliass

Convert Bilibili XML/protobuf danmaku to ASS subtitle

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.5.0
nixos-26.05 2.3.1
- nixos-26.05-small 2.3.1
- nixpkgs-26.05-darwin 2.3.1

pkgs.python314Packages.biliass

Convert Bilibili XML/protobuf danmaku to ASS subtitle

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.5.0
nixos-26.05 2.3.1
- nixos-26.05-small 2.3.1
- nixpkgs-26.05-darwin 2.3.1

Package maintainers

@linsui linsui <linsui555@gmail.com>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.biliass

pkgs.python313Packages.biliass

pkgs.python314Packages.biliass

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.biliass

pkgs.python313Packages.biliass

pkgs.python314Packages.biliass

Package maintainers