High 8.8Published Oct 8, 2026

CVE-2026-107639ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename

Updated under an hour ago (Oct 28, 2026, 4:23 AM ET)

Does this affect you?

It affects ILIAS-eLearning e.V. ILIAS. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.68%, higher than 52% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ILIAS-eLearning e.V. ILIAS

Exploited in the last 30 days

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-88
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.68% (percentile 52)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

ILIAS-eLearning e.V. ILIAS ilias_elearning_e.v:ilias (from the name)	from 9.0 before 9.24; from 10.0 before 10.12; from 11.0 before 11.5	CNA record

References

References

https://docu.ilias.de/go/blog/15821/952	vendor-advisory
https://docu.ilias.de/go/blog/15821/951	vendor-advisory
https://docu.ilias.de/go/blog/15821/950	vendor-advisory
https://github.com/ILIAS-eLearning/ILIAS/commit/ad1423c365a7ffd25bac711d995c643ce2af65c6	patch
https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestionGUI.php#L130	technical-description
https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestion.php#L290-L306	technical-description
https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.ilImagemapPreview.php#L208-L238	technical-description
https://github.com/ILIAS-eLearning/ILIAS	product
https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-argument-injection-via-image-map-question-upload-filename	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.