CVE-2026-107639
ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 8, 2026
- Updated
- Oct 10, 2026
- Reserved
- Oct 8, 2026
Description
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected Products
| Product | Versions |
|---|---|
ILIASILIAS-eLearning e.V. |
|
References
- https://docu.ilias.de/go/blog/15821/952vendor-advisory
- https://docu.ilias.de/go/blog/15821/951vendor-advisory
- https://docu.ilias.de/go/blog/15821/950vendor-advisory
- Patch Commitpatch
- https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestionGUI.php#L130technical-description
- https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestion.php#L290-L306technical-description
- https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.ilImagemapPreview.php#L208-L238technical-description
- https://github.com/ILIAS-eLearning/ILIASproduct
- VulnCheck Advisory: ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filenamethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.