Advisory · CVE-2026-107639
Remote code execution in ILIAS image map questions
ILIAS lets question authors inject ImageMagick options through uploaded image filenames, allowing remote code execution on the server.
- Vendor
- ILIAS
- Product
- ILIAS
- Identifier / CWE
- CVE-2026-107639
CWE-88 - Action timing
- Immediate
Explain it like I’m five
Teachers can upload pictures for quiz questions. A teacher can name the picture with secret instructions for the image tool, and the server follows the instructions instead of just resizing the picture.
- 01Author uploads image
A question author uploads an image whose filename embeds tab-separated ImageMagick options.
- 02Injection
The filename options escape the shell escaping and are interpreted by the convert command.
- 03PHP written
The attacker writes a PHP file under the web root and achieves remote code execution.
What happened
ILIAS versions before 9.24, 10.x before 10.12, and 11.x before 11.5 contain an argument injection vulnerability in the image map question component, disclosed in the ILIAS security announcement for the 9.24, 10.12, and 11.5 releases. A question author can inject ImageMagick convert options through an uploaded image filename, write a PHP file under the web root, and achieve remote code execution. The CVSS 4.0 score is 8.7.
ILIAS is one of the most widely deployed open-source learning platforms, which puts this in front of a lot of university infrastructure.
What to do
- Confirm your ILIAS version; anything before 9.24, 10.12, or 11.5 on its branch is affected.
- Upgrade to 9.24, 10.12, or 11.5 or later.
- Until upgraded, restrict question-authoring roles to trusted staff and review uploaded media filenames.
- Check the web root for unexpected PHP files and review server logs for ImageMagick invocations with unusual arguments.
Management note
The attacker model here is an insider with authoring rights, which universities hand out by the thousand. Patch like it is internet-facing, because the threat is already inside.