ILIAS: Unrestricted file upload via QTI import leads to remote code execution

Summary

ILIAS, an open-source e-learning platform, contains an unrestricted file upload flaw in the image handling of QTI question import (ilQtiMatImageSecurity). An authenticated user with question pool import rights can import a crafted archive that writes a .htaccess file and a PHP file into the web-served image directory. This allows remote code execution as the web server user, with full access to the server and its data.

Affected

• ILIAS 5.2.8 to before 9.24 (lower bound per CVE record, not independently confirmed)
• ILIAS 10.0 to before 10.12
• ILIAS 11.0 to before 11.5

Fixed in

• ILIAS 9.24
• ILIAS 10.12
• ILIAS 11.5

Workaround

No vendor workaround found. Until patching:

• Restrict question pool import rights to a small set of trusted staff.
• Review QTI image directories for unexpected .htaccess or PHP files.
• Make upload directories non-executable at the web server level where possible.
• Check ILIAS logs for recent QTI imports from unknown accounts.

Exploitation

• Publicly known: a third-party write-up claims a public PoC exists; contents not verified.
• VulDB lists the status as 0-Day (publicly known, not confirmed exploited).
• Not listed in CISA KEV according to a third-party tracker.
• EPSS 0.0064 (low predicted exploitation probability).
• In the wild: unknown. No reliable evidence of active exploitation found.

Our recommendation

• Upgrade to ILIAS 9.24, 10.12 or 11.5 as soon as possible; this is the main action.
• If ILIAS is internet-facing and authors or importers are not fully trusted, treat this as urgent.
• Restrict question pool import rights and review trusted accounts.
• Check upload directories for unexpected .htaccess or PHP files and review logs for suspicious QTI imports.
• Verify the affected version boundaries on the vendor advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• ILIAS 9.24 Security Advisory docu.ilias.de
• ILIAS 10.12 Security Advisory docu.ilias.de
• ILIAS 11.5 Security Advisory docu.ilias.de
• VulnCheck advisory www.vulncheck.com
• Fix commit 47c8462 github.com
• Fix commit 58ee5b1 github.com
• Fix commit 5b20035 github.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:06.