Argument Injection Vulnerability in ILIAS eLearning Platform by ILIAS eLearning
CVE-2026-107639

8.7HIGH

Key Information:

Vendor

Ilias-elearning E.v.

Status
Ilias
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107639?

ILIAS before version 9.24, versions 10.x before 10.12, and 11.x before 11.5 contain an argument injection vulnerability in the assImagemapQuestionGUI component. This vulnerability allows malicious question authors to inject ImageMagick convert options through the use of specially crafted uploaded image filenames. The exploit takes advantage of the fact that the escapeshellcmd() function fails to sanitize these inputs properly. As a result, attackers can manipulate the system to create a PHP file within the web root directory, leading to unauthorized remote code execution.

Affected Version(s)

ILIAS 9.0 < 9.24

ILIAS 10.0 < 10.12

ILIAS 11.0 < 11.5

References

https://docu.ilias.de/go/blog/15821/952
vendor-advisory
https://docu.ilias.de/go/blog/15821/951
vendor-advisory
https://docu.ilias.de/go/blog/15821/950
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

André Schweigert (SchweigertIT)
.