CVE-2020-36944 ILIAS Learning Management System 4.3 - SSRF

What is CVE-2020-36944?

CVE-2020-36944 is a medium-severity server-side request forgery vulnerability in ilias.de ILIAS Learning Management System, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF.

Weakness: CWE-918

Which versions are affected by CVE-2020-36944?

It affects 1 product.

Products include Ilias Ilias.

How do I fix CVE-2020-36944?

No fix has been published for CVE-2020-36944 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2020-36944 being exploited?

There is no known exploitation of CVE-2020-36944 in the wild and no public exploit code.

Other vulnerabilities in ilias.de ILIAS Learning Management System

• CVE-2023-36487 Auth bypass in n/a Critical 9.8
• CVE-2023-45869 Cross-site scripting in n/a Critical 9.0
• CVE-2022-45915 Command injection in n/a High 8.8
• CVE-2020-23996 Path traversal in n/a High 8.8
• CVE-2020-25268 Code injection in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2rvg-p9mc-wr6c.