ILIAS: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 5.1
  CVE-2025-55166

  svg-sanitizer By-Passing Attribute Sanitization

  savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripti…

  darylldoyle svg-sanitizer enshrined/svg-sanitize Packagist
  Aug 12, 2025
• Low 3.7
  CVE-2025-15284

  arrayLimit bypass in bracket notation allows DoS via memory exhaustion

  Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consist…

  langfuse-3-worker katib-suggestion-hyperopt katib-earlystopping katib-suggestion-skopt-enas Debian Ubuntu Azure Linux Wolfi npm
  Dec 29, 2025

Revision history

1. 2026-01-20 #1

   Initiale Fassung

References

• Ilias Security-Blog 10.5 vom 2026-01-20
  https://docu.ilias.de/go/blog/15821/899
• Ilias Security-Blog 9.17 vom 2026-01-20
  https://docu.ilias.de/go/blog/15821/898
• Ilias Release Notes 10.5 vom 2026-01-20
  https://docu.ilias.de/go/pg/220557_35
• Ilias Release Notes 9.17 vom 2026-01-20
  https://docu.ilias.de/go/pg/220555_35
• NIST CVE-2025-55166
  https://nvd.nist.gov/vuln/detail/CVE-2025-55166
• NIST CVE-2025-15284
  https://nvd.nist.gov/vuln/detail/CVE-2025-15284