CVE-2026-107639highCWE-88

CVE-2026-107639: falha de alta gravidade em ILIAS-eLearning e.V. ILIAS

ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename

Publicada em · Atualizada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
probabilidade de exploração
0.7%top 49% das CVEs
exploração observada
nãonenhuma fonte reporta
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ILIAS-eLearning e.V. · ILIAS
CVEs relacionadas — ILIAS-eLearning e.V. ILIAS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-80428CRITICALILIAS PHP Object Injection via Shibboleth LogoutEPSS 4.7%CVE-2026-82538HIGHILIAS Arbitrary SQL Injection via Repository Trash Table Sort ParameterEPSS 0.7%CVE-2026-108113HIGHILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI ImportEPSS 0.6%CVE-2026-110761HIGHILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results ImportEPSS 0.6%CVE-2026-82877HIGHILIAS Arbitrary File Read via SOAP addFileEPSS 0.5%CVE-2026-86416MEDIUMILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action MethodsEPSS 0.4%
Referências
https://docu.ilias.de/go/blog/15821/950https://docu.ilias.de/go/blog/15821/951https://docu.ilias.de/go/blog/15821/952https://github.com/ILIAS-eLearning/ILIAShttps://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestionGUI.php#L130https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestion.php#L290-L306https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.ilImagemapPreview.php#L208-L238https://github.com/ILIAS-eLearning/ILIAS/commit/ad1423c365a7ffd25bac711d995c643ce2af65c6https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-argument-injection-via-image-map-question-upload-filename