CVE-2026-108113

Summary

ILIAS allows authenticated users with question pool import rights to upload malicious files that can be executed as PHP code, leading to remote code execution. This vulnerability exists in versions before 9.24, 10.12, and 11.5.

Exploitability

Exploitation requires an authenticated user with question pool import privileges, which is moderately difficult but achievable through credential compromise or social engineering, and involves uploading a crafted archive containing .htaccess and PHP files to the web-served image directory.

Blast radius

The impact could be significant as attackers can execute arbitrary code as the web server user, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.

Detection

Monitor for unusual file creation patterns in web-served directories, particularly .htaccess and PHP files being written to image upload locations, and check web server logs for requests to newly created PHP files.

Prioritized remediation

Upgrade to ILIAS 9.24, 10.12, or 11.5 to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.