CVE-2026-108113: ILIAS 5.2.8 to before 9.24, 10.0 to before 10.12, 11.0 to before 11.5

Affected technology

ILIAS · 5.2.8 to before 9.24, 10.0 to before 10.12, 11.0 to before 11.5
ILIAS-eLearning e.V.

Description’s affected range: before 9.24, 10.12, and 11.5

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.