CVE-2026-110761: ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tstsequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated ILIAS user with permission to create or import Tests can exploit it. The attack requires uploading or importing a crafted Test archive.
What access and conditions does exploitation require?
The attacker needs valid authentication and Test creation or import permission; no user interaction is required. Exploitation relies on a malicious tst_sequence attribute in a Test archive reaching PHP unserialize().
What is the likely impact of a successful attack?
An attacker may abuse Guzzle or Monolog gadget chains to write PHP files and execute code. This can result in high-impact compromise of confidentiality, integrity, and availability.
Which versions should be remediated?
Update ILIAS to 9.24, 10.12, or 11.5, as applicable to the deployed release branch. Versions before those releases are affected.