Which versions of ILIAS are affected by CVE-2026-107639?

ILIAS LMS instances running versions before 9.24, 10.x before 10.12, or 11.x before 11.5 are exposed to a high-severity remote code execution flaw that allows a user with test-question authoring…. A patch is available.

How to fix or mitigate CVE-2026-107639?

Vendor-released patch: ILIAS 9.24, 10.12, and 11.5 (or later). Within 24 hours, inventory all ILIAS LMS deployments and identify any running versions before 9.24, 10.x before 10.12, or 11.x before 11.5; apply the vendor patch by upgrading to the fixed versions immediately, and if patching cannot be completed, temporarily restrict test-question authoring and image-map question permissions to trusted administrators only. Within 7 days, verify the patch across all instances, review web server and ILIAS logs for suspicious image uploads or unexpected PHP files under the web root, audit accounts with tutor/instructor authoring rights, and rotate credentials for any accounts suspected of compromise. Within 30 days, enforce least-privilege authoring roles, add file integrity monitoring for the web root, schedule regular vulnerability scans for the LMS, and establish a patch management SLA for internet-facing learning platforms.

ILIAS CVE-2026-107639

Q: What is the CVSS score of CVE-2026-107639?

CVE-2026-107639 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-95026 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-10-08 VulnCheck

GHSA-xh43-6gc2-xccj

PHP RCE Ilias Ilias Elearning E V

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable image upload with low complexity, but requires a question-author account so PR:L; argument injection yields webroot PHP write and full RCE giving C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:53 vuln.today

CVE Published

Oct 08, 2026 - 14:10 cve.org

HIGH 8.7

DescriptionCVE.org

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 3 Critical, 7 High Severity Patched Oct 09, 2026

AnalysisAI

Remote code execution in ILIAS LMS (before 9.24, 10.x before 10.12, and 11.x before 11.5) allows an authenticated user with test-question authoring rights to inject ImageMagick convert options through the filename of an uploaded image in an image-map question. Because escapeshellcmd() does not neutralise tab characters, an author can smuggle extra command arguments that instruct convert to drop a PHP file under the web root, which is then executable by any visitor and yields remote code execution on the server. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated ILIAS account with question-authoring rights in a test question pool (e.g., tutor/instructor role), the ability to create or edit an image map question handled by assImagemapQuestionGUI, and uploading an image whose filename embeds tab-separated ImageMagick 'convert' options that escapeshellcmd() fails to neutralise. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, actionable priority rather than a CVSS-inflated non-issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to ILIAS 9.24, 10.12, or 11.5, which contain the fix (commit ad1423c365a7ffd25bac711d995c643ce2af65c6) that validates the upload extension against a jpg/jpeg/png/gif whitelist and replaces the attacker-controlled filename with a random hex name, eliminating the argument-injection vector entirely. … Detailed patch versions, workarounds, and compensating controls in full report.