CVE-2026-108113
highILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows…
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://docu.ilias.de/go/blog/15821/950 disclosure@vulncheck.com
- https://docu.ilias.de/go/blog/15821/951 disclosure@vulncheck.com
- https://docu.ilias.de/go/blog/15821/952 disclosure@vulncheck.com
- https://github.com/ILIAS-eLearning/ILIAS disclosure@vulncheck.com
- https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/QTI/classes/class.il... disclosure@vulncheck.com
- https://github.com/ILIAS-eLearning/ILIAS/commit/47c8462bf46bbebd543a9f3b39c7896b0e9e7362 disclosure@vulncheck.com
- https://github.com/ILIAS-eLearning/ILIAS/commit/58ee5b1767212530f9948adb0e7d5aecec66ce60 disclosure@vulncheck.com
- https://github.com/ILIAS-eLearning/ILIAS/commit/5b200351330bee698432a45c0877c5bc694c367a disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-unrestricted-file-up... disclosure@vulncheck.com