Read the docs
TI-2026-69589 Aliases CVE-2026-107639GHSA-xh43-6gc2-xccj

Argument injection in ILIAS image map uploads enables code execution

Priority MEDIUM 41CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

ILIAS from 9.0 before 9.24, from 10.0 before 10.12, and from 11.0 before 11.5 is affected. The assImagemapQuestionGUI component passes tab-separated options in uploaded image filenames to ImageMagick, and escapeshellcmd() does not neutralise them (CWE-88). A question author with low privileges can upload a crafted filename that writes a PHP file under the web root, which allows remote code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00678 52nd percentileScored 2026-11-07
Fix Fixed ILIAS (ILIAS-eLearning e.V.): 9.24, 10.12, 11.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ILIAS-eLearning e.V.ILIAS9.0 to before 9.24; 10.0 to before 10.12; 11.0 to before 11.59.24, 10.12, 11.5Patch availableCNA
  • ILIAS VendorILIAS-eLearning e.V. Affected 9.0 to before 9.24; 10.0 to before 10.12; 11.0 to before 11.5 Fixed in 9.24, 10.12, 11.5 Patch available CNA

Remediation

Upgrade ILIAS to version 9.24, 10.12, or 11.5, which fix the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA ILIAS (ILIAS-eLearning e.V.) Fixed in 9.24, 10.12, 11.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ILIAS-eLearning e.V. ILIAS — ILIAS 11.5 Security Advisory (Mantis 0048413)

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run codePriority MEDIUM 41
    • TI-2026-74420 PHP object injection in ILIAS test results importPriority MEDIUM 40
    Show all 3 records → Advisory →
  • Advisory ·

    ILIAS-eLearning e.V. ILIAS — ILIAS 9.24 Security Advisory (Mantis 0048413)

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run codePriority MEDIUM 41
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    ILIAS-eLearning e.V. ILIAS — ILIAS 10.12 Security Advisory (Mantis 0048413)

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run codePriority MEDIUM 41
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107639
  2. 2026-10-08 Alias added: GHSA-xh43-6gc2-xccj
  3. 2026-10-10 CISA SSVC decision points changed
  4. 2026-10-10 Priority changed: MEDIUM → LOW
  5. 2026-10-10 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 3

Other 4

  • TI-2026-55506 ILIAS PHP Object Injection via Shibboleth Logout CVSS 4.0CRITICAL 9.3
  • TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run code CVSS 4.0HIGH 8.7
  • TI-2026-56895 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter CVSS 4.0HIGH 8.7
  • TI-2026-74420 PHP object injection in ILIAS test results import CVSS 4.0HIGH 8.7
  • TI-2026-57181 ILIAS Arbitrary File Read via SOAP addFile CVSS 4.0HIGH 7.1
  • TI-2026-59124 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences