ILIAS LMS EUVD-2026-95886

Exploitation requires an authenticated ILIAS account holding question-pool (QTI) import rights - i.e., author/tutor-level permissions - not anonymous access. The attack is triggered specifically through the QTI question-import image-handling path (ilQtiMatImageSecurity), where a crafted import archive can write a .htaccess plus a PHP file into the web-served image directory. Limiting factors: the attacker must already be a trusted authoring user and the target must run an affected version (before 9.24, 10.12, or 11.5); instances that restrict import rights to vetted staff materially reduce realistic risk. No special non-default configuration is otherwise required - the vulnerable import handling is standard behavior in affected versions.

This is a credible, high-priority vulnerability but not an emergency for most organizations. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring low privileges (PR:L) and no user interaction, with full compromise of the vulnerable system (VC:H/VI:H/VA:H) - consistent with CWE-434 unrestricted file upload leading to RCE as the web server user. The key limiting signal is PR:L: the attacker must already be an authenticated ILIAS user holding question-pool import rights (an author/tutor-level privilege), so this is not an anonymous internet-wide RCE. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation probability cannot be quantified; absence of KEV means there is no evidence of active exploitation. The source-code patch diff is detailed and confirms the vulnerable mechanism (validation bypass in ilQtiMatImageSecurity allowing .htaccess + PHP writes into the web-served directory), which raises confidence that a working exploit is readily derivable from the public commits even though no standalone POC is referenced. Net: real, patch-worthy priority for ILIAS operators who have untrusted authors, but the required insider/author privilege and niche product footprint keep real-world mass-exploitation risk moderate rather than critical.

An authenticated ILIAS user with question-pool import rights (e.g., a course author or a self-registered user granted authoring on a permissive instance) uploads a crafted QTI import archive. The archive abuses the image-handling path to drop a .htaccess file plus a PHP payload into the web-served image directory, which the attacker then requests over HTTP to execute arbitrary code as the web server user. No separate public POC is referenced, but the published patch commits disclose the exact bypass.