ILIAS: Argument injection in image map question upload leads to code execution

Summary

ILIAS learning platform versions 9.0 to before 9.24, 10.0 to before 10.12 and 11.0 to before 11.5 contain an argument injection flaw in the image map question type. A user with question-author rights can upload an image with crafted filename options that are passed to ImageMagick, so escapeshellcmd() does not neutralise them. The attacker can then write a PHP file under the web root and execute code on the server. The attack requires an authenticated account with author rights, not an anonymous user.

Affected

• ILIAS 9.0 to before 9.24
• ILIAS 10.0 to before 10.12
• ILIAS 11.0 to before 11.5
• Default configuration: unaffected per CNA record

Fixed in

• ILIAS 9.24
• ILIAS 10.12
• ILIAS 11.5

Workaround

• Unknown. No vendor workaround found in the sources reviewed.

Exploitation

• Not known to be exploited in the wild. The CVE tracker lists KEV: No.
• No public proof of concept found; status unknown, not confirmed absent.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS 0.00678 (Vulners).

Our recommendation

• Identify all ILIAS instances and confirm their versions.
• Upgrade to 9.24, 10.12 or 11.5; a 9.x instance may need a version upgrade.
• Limit the question-author role to trusted staff and review the account list.
• Check existing image map questions and uploads for unexpected files, such as PHP files in web directories.
• Back up the instance and database before upgrading.
• Prioritise instances that are internet-facing or have many trainer accounts.
• The same releases fix other authenticated code-execution flaws, so one upgrade covers them.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• ILIAS security blog 9.24 (advisory 950) docu.ilias.de
• ILIAS security blog advisory 951 docu.ilias.de
• ILIAS security blog advisory 952 docu.ilias.de
• ILIAS fix commit github.com
• VulnCheck advisory www.vulncheck.com
• ILIAS release v9.24 github.com
• VulDB entry vuldb.com
• OSV entry osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:16.