{"id":"CVE-2026-108113","published":"2026-10-09T16:17:26.917","lastModified":"2026-10-13T17:17:19.263","description":"ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://docu.ilias.de/go/blog/15821/950","tags":[]},{"url":"https://docu.ilias.de/go/blog/15821/951","tags":[]},{"url":"https://docu.ilias.de/go/blog/15821/952","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/QTI/classes/class.ilQtiMatImageSecurity.php#L110-L122","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/47c8462bf46bbebd543a9f3b39c7896b0e9e7362","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/58ee5b1767212530f9948adb0e7d5aecec66ce60","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/5b200351330bee698432a45c0877c5bc694c367a","tags":[]},{"url":"https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-unrestricted-file-upload-via-qti-import","tags":[]}],"exploitRefs":[{"url":"https://github.com/ILIAS-eLearning/ILIAS","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/QTI/classes/class.ilQtiMatImageSecurity.php#L110-L122","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/47c8462bf46bbebd543a9f3b39c7896b0e9e7362","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/58ee5b1767212530f9948adb0e7d5aecec66ce60","tags":[]},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/5b200351330bee698432a45c0877c5bc694c367a","tags":[]}],"hasPoc":true,"ai":{"summary":"ILIAS allows authenticated users with question pool import rights to upload malicious files that can be executed as PHP code, leading to remote code execution. This vulnerability exists in versions before 9.24, 10.12, and 11.5.","exploitability":"Exploitation requires an authenticated user with question pool import privileges, which is moderately difficult but achievable through credential compromise or social engineering, and involves uploading a crafted archive containing .htaccess and PHP files to the web-served image directory.","blast_radius":"The impact could be significant as attackers can execute arbitrary code as the web server user, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.","remediation":"Upgrade to ILIAS 9.24, 10.12, or 11.5 to remediate this vulnerability.","detection":"Monitor for unusual file creation patterns in web-served directories, particularly .htaccess and PHP files being written to image upload locations, and check web server logs for requests to newly created PHP files.","tags":["rce","file-upload","web","auth"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:52:09.523Z"}}