Unrestricted File Upload Vulnerability in ILIAS eLearning Platform

CVE-2026-108113

What is CVE-2026-108113?

The ILIAS eLearning platform suffers from an unrestricted file upload vulnerability within the QTI question import functionality. Authenticated users with question pool import rights can exploit this flaw to upload malicious files, including executable PHP scripts, to the web server. This capability can lead to remote code execution as the web server user, compromising the security and integrity of the affected system. It is crucial for administrators to apply available patches to mitigate this risk. Versions prior to 9.24, 10.12, and 11.5 are particularly susceptible.

References