Threats tagged 'ghsa-v9q7-6vp4-97vg'

ILIAS versions before 9.24, 10.12, and 11.5 have an unrestricted file upload vulnerability in the QTI question import image handling component. Authenticated users with question pool import rights can upload crafted archives that write executable files, including .htaccess and PHP files, to web-accessible directories. This allows remote code execution as the web server user.