Vulnerability · Published Oct 9, 2026 · Assigned by VulnCheck

CVE-2026-108113ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import

High 8.8

In plain English

A high-severity unrestricted file upload in ILIAS from ILIAS-eLearning e.V.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 49.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.

Affected products (as reported)

Vendor	Product	Versions
ILIAS-eLearning e.V.	ILIAS	5.2.8 – before 9.2410.0 – before 10.1211.0 – before 11.5

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

ILIAS 11.5 Security Advisory (Mantis 0048413) vendor-advisory
ILIAS 10.12 Security Advisory (Mantis 0048413) vendor-advisory
ILIAS 9.24 Security Advisory (Mantis 0048413) vendor-advisory
QTI: Fix Matimage Filename And Content Bypass (release_9) patch
QTI: Fix Matimage Filename And Content Bypass (release_10) patch
QTI: Fix Matimage Filename And Content Bypass (release_11) patch
ilQtiMatImageSecurity::validateLabel() at v10.11 technical-description
https://github.com/ILIAS-eLearning/ILIAS product
VulnCheck Advisory: ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import third-party-advisory