CVE-2026-108113
Deferred Deferred - Pending Action

ILIAS Unrestricted File Upload Leading to RCE

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: VulnCheck

Description
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-108113
EUVD
EUVD-2026-95886

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ILIAS-eLearning e.V. ILIAS 5.2.8
ILIAS-eLearning e.V. ILIAS 10.0
ILIAS-eLearning e.V. ILIAS 11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108113 is an unrestricted file upload vulnerability in ILIAS versions before 9.24, 10.12, and 11.5. It affects QTI question import image handling where authenticated authors with question pool import rights can upload crafted archives containing .htaccess and PHP files. These files are written to the web-served image directory, allowing remote code execution as the web server user.

Detection Guidance

Check ILIAS logs for suspicious QTI import activities or unexpected file writes in the image directory. Review files in the web-served image directory for unauthorized .htaccess or PHP files. Use commands like 'find /path/to/images -name "*.php" -o -name ".htaccess"' to detect malicious files.

Impact Analysis

This vulnerability allows attackers with import rights to execute arbitrary code on the server hosting ILIAS. This could lead to full system compromise, data theft, or unauthorized access to sensitive information stored on the server. The impact depends on the server's configuration and the attacker's goals.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for data protection and confidentiality. Organizations using vulnerable ILIAS versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade ILIAS to version 9.24, 10.12, or 11.5 or later. Remove any unauthorized .htaccess or PHP files from the image directory. Restrict write permissions to the image directory and review user roles to ensure only trusted authors have import rights.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart