The vulnerability is an unrestricted file upload flaw in the QTI import feature of ILIAS that allows authenticated authors to upload arbitrary files, including executable PHP scripts, to the web‑served image directory. By crafting a ZIP archive containing a .htaccess file and a PHP file, an attacker with question‑pool import rights can trigger remote code execution under the web‑server user account. The weakness is identified as CWE‑434 and carries a CVSS base score of 8.7.

ILIAS eLearning e.V.'s product ILIAS is affected in all releases prior to version 9.24, 10.12, and 11.5. The flaw resides in the ilQtiMatImageSecurity component that processes image uploads during QTI question import. System administrators should verify the installed version and determine whether it matches the vulnerable releases.

The high severity rating (8.7) indicates significant impact if exploited. Although an EPSS score is not available and the vulnerability is not included in the CISA KEV catalog, the attack path is straightforward for any user who has been granted import privileges. An attacker who can upload a crafted archive can achieve remote code execution, exposing the entire web application and potentially pivoting to other services. Prompt remediation is recommended due to the clear possibility of compromise.