Security researchers discovered three previously unknown vulnerabilities enabling remote code execution in ILIAS versions 8, 9, and 10. The flaws include one unauthenticated RCE via course certificate import and two authenticated RCE vulnerabilities from insecure deserialization. All were responsibly disclosed and patched. The unauthenticated exploit targets public certificate functions, allowing attackers to upload malicious files without login.

The core attack vector involves uploading a ZIP archive containing a PHP payload and a custom `.htaccess` file. ILIAS extracts the archive to a web-accessible directory, but a global `.htaccess` at the document root normally prevents script execution. By including an overriding `.htaccess` in the ZIP, attackers can disable the protective rewrite rules and configure Apache to execute files with a custom extension, bypassing security controls.

While the vulnerabilities required specific ILIAS configurations—like public certificate objects—to be exploitable, they underscore common risks in web applications handling file uploads and complex access controls. Organizations running self-hosted ILIAS instances should verify they've applied the patches. The research highlights how seemingly minor permission oversights, like missing `write` checks, can chain into full system compromise.