CVE-2025-11346: ILIAS Base64 Decoding unserialize deserialization
A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument fsettings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11346?
The severity of CVE-2025-11346 is considered to be critical due to its potential for remote exploitation through deserialization.
How do I fix CVE-2025-11346?
To fix CVE-2025-11346, upgrade ILIAS to version 8.24 or later.
Which versions of ILIAS are affected by CVE-2025-11346?
CVE-2025-11346 affects ILIAS versions up to and including 8.23, 9.13, and 10.1.
Can CVE-2025-11346 be exploited remotely?
Yes, CVE-2025-11346 can be exploited remotely by manipulating the unserialize function.
What component is impacted by CVE-2025-11346?
CVE-2025-11346 impacts the Base64 Decoding Handler component of ILIAS.