CVE-2026-107639 in ILIAS
Summary
by MITRE • 10/08/2026
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in ILIAS versions prior to 9.24, 10.x before 10.12, and 11.x before 11.5 represents a critical server-side flaw rooted in improper input validation within the assImagemapQuestionGUI component. This module is designed to allow question authors to create interactive image maps for educational assessments, which inherently requires processing uploaded images through external system utilities such as ImageMagick. The core technical failure lies in how the application handles filenames associated with these uploads when passing them to shell commands. Specifically, the developers relied on PHP's escapeshellcmd function to sanitize user-supplied input before execution. However, this sanitization mechanism is insufficient for preventing argument injection attacks because it does not neutralize tab characters or other whitespace that can be interpreted by the underlying operating system as command separators. Consequently, an attacker who has the ability to upload images with crafted filenames can inject arbitrary ImageMagick convert options directly into the shell execution context.
The operational impact of this vulnerability is severe, leading directly to Remote Code Execution (RCE) on the affected server. By embedding tab-separated arguments within the image filename, a malicious actor can manipulate the ImageMagick conversion process to write files outside of their intended directory structure. In many standard configurations, particularly those involving web servers like Apache or Nginx with default settings, this manipulation allows for the creation of PHP script files directly under the web root directory. Once these PHP files are written and accessible via HTTP requests, an attacker can execute arbitrary server-side code by simply accessing the crafted file through a browser or automated tooling. This effectively grants full control over the underlying operating system, enabling data exfiltration, persistence mechanisms, lateral movement within the network, and complete compromise of the ILIAS instance's integrity and confidentiality.
From a classification perspective, this vulnerability aligns with CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The specific technique employed here leverages argument injection rather than direct command substitution, exploiting the way arguments are parsed by external binaries invoked via system calls. In terms of adversary behavior mapping to MITRE ATT&CK frameworks, this activity corresponds to T1059.004, which covers Unix Shell Commands under Command and Scripting Interpreter techniques. The attack vector is classified as Local or Network depending on the specific deployment context where authenticated access to question authoring features is available, but it fundamentally represents a path traversal combined with command injection leading to code execution.
Mitigation strategies must focus immediately on upgrading the ILIAS installation to version 9.24, 10.12, or 11.5 and later, as these releases contain patches that address the input validation flaws in assImagemapQuestionGUI. Until an upgrade is feasible, administrators should implement strict file upload restrictions at the web server level to prevent PHP files from being written into executable directories regardless of application logic errors. Additionally, enforcing allowlists for permitted image formats and restricting the use of external command-line tools where possible can reduce the attack surface. It is also advisable to review access controls around question authoring modules to ensure that only trusted users with legitimate educational needs have upload privileges, thereby limiting the potential pool of attackers capable of exploiting this flaw.