{"id":"CVE-2026-108113","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-108113","generatedAt":"2026-10-28T01:49:20.311Z","title":"ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files.","description":"ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.","published":"2026-10-09T16:17:27.000Z","lastModified":"2026-10-13T17:17:19.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-434"],"affected":[],"epss":{"score":0.0064,"percentile":0.50398,"date":"2026-10-26","history":[{"date":"2026-10-10","score":0.0064,"percentile":0.49164}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-09T16:17:27.000Z","detail":{"score":"8.7","severity":"HIGH","publishedAt":"2026-10-09T16:17:26.917Z"},"summary":"New CVE, high severity (CVSS 8.7)."}],"references":[{"url":"https://docu.ilias.de/go/blog/15821/950","source":"disclosure@vulncheck.com"},{"url":"https://docu.ilias.de/go/blog/15821/951","source":"disclosure@vulncheck.com"},{"url":"https://docu.ilias.de/go/blog/15821/952","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/QTI/classes/class.ilQtiMatImageSecurity.php#L110-L122","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/47c8462bf46bbebd543a9f3b39c7896b0e9e7362","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/58ee5b1767212530f9948adb0e7d5aecec66ce60","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/5b200351330bee698432a45c0877c5bc694c367a","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-unrestricted-file-upload-via-qti-import","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108113","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}