CVE-2026-107639: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in ILIAS-eLearning e.V. ILIAS

CVE-2026-107639 is an argument injection vulnerability in ILIAS-eLearning e.V.'s ILIAS software affecting versions >=9.0 <9.24, >=10.0 <10.12, and >=11.0 <11.5. The vulnerability exists in the assImagemapQuestionGUI module where uploaded image filenames can include tab-separated ImageMagick convert options that are not properly neutralized by escapeshellcmd(). This allows an attacker with question author privileges to inject commands that write a PHP file under the web root, leading to remote code execution.

Successful exploitation allows an attacker with question author privileges to execute arbitrary code on the server by writing a PHP file under the web root. This can lead to full compromise of the affected system. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict question author privileges to trusted users only and monitor for suspicious file uploads related to image filenames.