{"id":"CVE-2026-107639","published":"2026-10-08T15:17:47.117","lastModified":"2026-10-10T04:18:09.920","description":"ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://docu.ilias.de/go/blog/15821/950","tags":[]},{"url":"https://docu.ilias.de/go/blog/15821/951","tags":[]},{"url":"https://docu.ilias.de/go/blog/15821/952","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestion.php#L290-L306","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestionGUI.php#L130","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.ilImagemapPreview.php#L208-L238","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/ad1423c365a7ffd25bac711d995c643ce2af65c6","tags":[]},{"url":"https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-argument-injection-via-image-map-question-upload-filename","tags":[]}],"exploitRefs":[{"url":"https://github.com/ILIAS-eLearning/ILIAS","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestion.php#L290-L306","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestionGUI.php#L130","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.ilImagemapPreview.php#L208-L238","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/ad1423c365a7ffd25bac711d995c643ce2af65c6","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to inject ImageMagick convert options via uploaded image filenames, leading to remote code execution. This is significant because it enables unauthorized execution of arbitrary code on the server.","exploitability":"Exploitation requires attackers to upload a specially crafted image file. The vulnerability is relatively easy to exploit given the preconditions.","blast_radius":"If exploited, the impact could be severe, allowing attackers to fully compromise the server and gain control over the system.","remediation":"Upgrade to ILIAS 9.24 or later, 10.12 or later, or 11.5 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","upload","image"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:54.807Z"}}