CVE-2026-108113
ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import
ILIAS-eLearning e.V. ILIAS
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.64%Chance of exploitation activity in the next 30 days, higher than 50% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.
Text from CVE List
Affected versions 3
- ILIASaffected: 5.2.8 before 9.24CVE List
- ILIASaffected: 10.0 before 10.12CVE List
- ILIASaffected: 11.0 before 11.5CVE List
References 9
- github.com/ILIAS-eLearning/ILIAS/commit/58ee5b1767212530f9948adb0e7d5aecec66ce60Fixvia CVE List
- github.com/ILIAS-eLearning/ILIAS/commit/5b200351330bee698432a45c0877c5bc694c367aFixvia CVE List
- github.com/ILIAS-eLearning/ILIAS/commit/47c8462bf46bbebd543a9f3b39c7896b0e9e7362Fixvia CVE List
- docu.ilias.de/go/blog/15821/952Advisoryvia CVE List
- docu.ilias.de/go/blog/15821/951Advisoryvia CVE List
- docu.ilias.de/go/blog/15821/950Advisoryvia CVE List
- github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/QTI/classes/class.ilQtiMatImageSecurity.php#L110-L122Advisoryvia CVE List
- vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-unrestricted-file-upload-via-qti-importAdvisoryvia CVE List
- github.com/ILIAS-eLearning/ILIASReferencevia CVE List