HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-107639 — ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument i...

·Source: NIST NVD

Updated:

Executive Summary

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

Analysis

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution. CVSS Score: 8.8. Published: 2026-10-08T15:17:47.117.

Indicators of Compromise (1)

CVE (1)
CVE-2026-107639
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

There's only so much code: the rise in vulnerability numbers

The September Microsoft Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?

Cisco Talos
MEDIUMVulnerability

DOJ escalates fight for election supremacy with California raids

The arrests were paired with comments from DOJ and DHS officials, threatening to investigate, arrest or prosecute tens of thousands of California voters if they vote in November. The post DOJ escalates fight for election supremacy with California raids appeared first on CyberScoop .

CyberScoop
MEDIUMVulnerability

Ramp applies for national bank trust charter

Ramp has become the latest fintech to apply for a US national bank charter, enabling the expense management platform to offer fiduciary investment management and custody of digital assets.

Finextra