Download & Releases

9.24 (stable)

General Information

Release 9.24 has been published on October 6, 2026

Please read the ILIAS 9 feature page for information about new and abandoned features and changed behaviour of this version.
You find information about first time installation of ILIAS 9 and updating here.
Please also have a look at the Required Software for ILIAS 9 page.

ILIAS is free, open source software and published under the GNU General Public License (GPL), version 3.0 → Licence

Download

ILIAS-9.24.zip
Download (github.com)
160 MB, 2026-10-06
md5: 07d27d16939eb53000df5b43058f1c98

ILIAS-9.24.tar.gz
Download (github.com)
144 MB, 2026-10-06
md5: 3ce30ca58b66774ad136a692d3f46dad

Important Changes

System Styles: Custom system styles from 8 and earlier do no longer work
- With ILIAS 9 the SCSS has been restructered according to the ITCSS structure suggested in the SASS guidelines. In addition, the depencency to less from Bootstrap has mostly been removed. However, the change from less to SCSS and the abandonment from Bootstrap means, that System Styles from 8 and lower are NOT compatible with ILIAS 9. They cannot be imported, be used, or compiled.
- However, note, that most of the css should still work. Also less and scss are not that far appart. Best read through our SCSS Coding Guidelines to get started.
JavaScript Dependencies: Removal of 'node_modules' folder from Git repository
- The 'npm' dependencies and thus the 'node_modules' folder in the ILIAS root directory were removed from the ILIAS codebase.
- All 'npm' dependencies will still be automatically added to the release builds (linked on the official ILIAS release pages) on GitHub.
- With this change 'npm' will become a requirement for ILIAS installations based on Git branches/tags. To install the 'npm' dependencies on such installations, you'll have to execute:
  
  npm clean-install --omit=dev --ignore-scripts
- The --omit=dev flag can be ignored for development installations.
Chat Server: Removal of 'node_modules' folder from Git repository
- The 'npm' dependencies and thus the 'node_modules' folder of 'Modules/Chatroom/chat' were removed from the ILIAS codebase in Git with the integration of PR 5128.
- All 'npm' dependencies will still be automatically added to the release builds (linked on the official ILIAS release pages) on GitHub.
- With this change 'npm' will become a requirement for ILIAS installations based on Git branches/tags. To install the 'npm' dependencies on such installations, you'll have to execute:
  
  npm clean-install --omit=dev --ignore-scripts
  
  The --omit=dev flag can be ignored for development installations.
Cron Jobs:
- With ILIAS ≧ 9.x and the application of PR 5720 the password must be omitted when executing the ILIAS cron CLI script, see also Installation and Maintenance: Cron Jobs.
PDF Generation:
- wkhtmltopdf has been removed from the code base.
Authentication/SAML:
- Due to an major release upgrade of the underlying 3rd party library, existing configuration files for SimpleSAMLphp have to be adopted according to the documention.
  - See: https://github.com/ILIAS-eLearning/ILIAS/tree/release_9/Services/Saml#config-changes-in-ilias-9 / https://simplesamlphp.org/docs/stable/simplesamlphp-upgrade-notes-2.0.html
- Furthermore, existing federations between ILIAS and SAML IPDs have to re-established due to necessary changes in the metadata XML file.
- When installing the composer dependencies on an existing installation, it might occur that you receive an error caused by the simplesamlphp/simplesamlphp library. In this case, simply remove the vendor folder once by executing: rm -rf ./libs/composer/vendor . Afterwards, install the composer dependencies as usual.
MathJax:
- Please check if you configured a polyfill url at Administration » Third Party Software » MathJax. This is not needed by modern browsers and IE 11 is no longer supported by ILIAS at all. You should NOT use the polyfill.io library any longer, see https://sansec.io/research/polyfill-supply-chain-attack for details.

Known Issues

none

Changed Behaviour

Test & Assessment: Import of Tests with Results: It is no longer possible to deselect questions during the import.
Test & Assessment: Filter "Active Users only" / "Inactive Users only" in Manual Scoring is removed.
Test & Assessment: "Auto-saved" or intermediate answers are not saved anymore as authorised answers when the set test duration limit ends.
Test & Assessment: Zero will no longer be accepted as value for points in File Upload Questions.
Test & Assessnment: The redirect after finishing the test does only work if the participant does not have access to his test results. The info for this setting stated this, but until this bug fix with 44025, the redirect always "wins." 44025 was fixed with ILIAS 9.8, but many institutions are upgrading now to ILIAS 9. So we decided to document this bug fix nevertheless within Changed behavior.
Test & Assessment: Redirect: Starting with Version 9.15, we introduce a separate option to redirect to the logout screen, as redirecting to https://instance.url/logout.php does not work anymore since ILIAS 9.13.
Learning Sequence: With ILIAS 9.15 an ambigousness within the Online Status of Learning Sequences was fixed. Due to the resolvement of this corrupt state certain Learning Sequences that apperently seemed online are correctly portait offline. Affected are all Copies of Learning Sequences there where included in a container copy process and not accessed since then until the release of ILIAS 9.15
Mediacast: With version 9.17 the autoplay feature has been removed, see Mantis issue 38134.

Security Fixes

The following security issues have been fixed. For more information about these vulnerabilities, see our 9.24 security blog post.

#47077: [File] File Services: Prohibited file suffixes bypassable (Martin-Luther-Universität Halle-Wittenberg)
#48028: [Test & Assessment] Authenticated RCE via Test import (André Schweigert (FAU|ILIAS))
#48072: [xAPI] Authenticated RCE via CmiXapi (André Schweigert ( FAU | ILIAS ))
#48213: [News] Stored XSS in the news (André Schweigert (FAU|ILIAS))
#48292: [Test & Assessment] Unauthenticated test-question rendering (André Schweigert (FAU|ILIAS))
#48298: [Forum] Fix forum attachment download processes ignored forum binding
#48313: [Calendar] Unauthenticated user and role enumeration via calendar (André Schweigert (FAU|ILIAS))
#48359: [Test & Assessment] Close RCE in ImageMap Question by Removing Unnecessary Code (André Schweigert (SchweigertIT))
#48362: [Staff] Broken access control in MyStaff (Peter Reichartz)
#48365: [Test & Assessment] Fix file deletion through uncaught file traversal opportunity in SingleChoice, MultipleChoice, KPrim, Matching, and Ordering Questions (André Schweigert (SchweigertIT))
#48366: [Learning Module SCORM 2004] Stored XSS in SCORM tracking reports (André Schweigert (SchweigertIT))
#48402: [Test & Assessment] Prevent Accessing Anonymous Test Run by Providing Active Id Only
#48413: [Test & Assessment] RCE via questionpool import (André Schweigert (SchweigertIT))
#48414: [Test & Assessment] RCE in ImageMapQuestion (André Schweigert (SchweigertIT))
#48447: [Survey] Anonymous user enumeration via Survey (André Schweigert (FAU|ILIAS))
#48453: [File] File: Anonymous users could download file objects without permission when the public area was enabled. (Isira Adithya (@isira_adithya, https://github.com/isira-adithya))

Fixed Issues

The following issues reported in Mantis have been resolved: