CVE-2026-108113
published 2026-10-09CVE-2026-108113: ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.64%
49.6th percentile
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ilias-elearning_e.v | ilias | >= 10.0 < 10.12 | 10.12 |
| ilias-elearning_e.v | ilias | >= 11.0 < 11.5 | 11.5 |
| ilias-elearning_e.v | ilias | >= 5.2.8 < 9.24 | 9.24 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ILIAS up to 9.23/10.11/11.4 QTI Question Import Image ilQtiMatImageSecurity unrestricted upload
vuldb·2026-10-09·CVSS 8.8
CVE-2026-108113 [HIGH] ILIAS up to 9.23/10.11/11.4 QTI Question Import Image ilQtiMatImageSecurity unrestricted upload
A vulnerability labeled as critical has been found in ILIAS up to 9.23/10.11/11.4. This issue affects the function ilQtiMatImageSecurity of the component QTI Question Import Image Handler. Executing a manipulation can lead to unrestricted upload.
This vulnerability is handled as CVE-2026-108113. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executabl
ghsa_unreviewed·2026-10-09
CVE-2026-108113 [HIGH] CWE-434 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executabl
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docu.ilias.de/go/blog/15821/950https://docu.ilias.de/go/blog/15821/951https://docu.ilias.de/go/blog/15821/952https://github.com/ILIAS-eLearning/ILIAShttps://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/QTI/classes/class.ilQtiMatImageSecurity.php#L110-L122https://github.com/ILIAS-eLearning/ILIAS/commit/47c8462bf46bbebd543a9f3b39c7896b0e9e7362https://github.com/ILIAS-eLearning/ILIAS/commit/58ee5b1767212530f9948adb0e7d5aecec66ce60https://github.com/ILIAS-eLearning/ILIAS/commit/5b200351330bee698432a45c0877c5bc694c367ahttps://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-unrestricted-file-upload-via-qti-import
2026-10-09
Published