CVE-2026-107639

The ILIAS learning management system versions before 9.24 , 10.x before 10.12 , and 11.x before 11.5 are vulnerable to an argument injection vulnerability in the assImagemapQuestionGUI component. The root cause is that escapeshellcmd() fails to neutralize tab-separated options embedded within upl...