ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
CVE-2026-107639
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107639
ILIAS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/ILIAS-eLearning/ILIAS",
"vendor": "ILIAS-eLearning e.V.",
"product": "ILIAS",
"versions": [
{
"status": "affected",
"version": "9.0",
"lessThan": "9.24",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.0",
"lessThan": "10.12",
"versionType": "custom"
},
{
"status": "affected",
"version": "11.0",
"lessThan": "11.5",
"versionType": "custom"
}
],
"packageURL": "pkg:github/ILIAS-eLearning/ILIAS",
"collectionURL": "https://github.com/ILIAS-eLearning/ILIAS",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-107639
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #16564 · Revision 1
- Added to Heist Feed
- Publisher date