CVE-2026-107639

HighCVSS 8.8/10Last modified Oct 10, 2026

Description

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-107648.7Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.CVE-2026-1076409.1Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthentCVE-2026-1076459.1The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to theCVE-2026-1076465.3The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versionCVE-2026-1076487.2The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also functCVE-2026-1076495.4The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versiCVE-2026-1076506.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site ScCVE-2026-1076515.5A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when pCVE-2026-1076525.3The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and includingCVE-2026-1076554.0A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attribuCVE-2026-1076577.2The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via tCVE-2026-1076597.5The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u
CVE-2026-107639: High severity, CVSS 8.8 | Vulnix