CVE-2026-18745: ILIAS PHP Object Injection via Shibboleth Logout
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ILIASto a version that resolves this vulnerability.Fixed in 9.22 - Upgrade
Upgrade
ILIASto a version that resolves this vulnerability.Fixed in 10.10 - Upgrade
Upgrade
ILIASto a version that resolves this vulnerability.Fixed in 11.3
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can use the LTI authentication endpoint to place serialized objects in session storage, then trigger deserialization through the Shibboleth back-channel logout endpoint.
What is the likely impact of successful exploitation?
Successful exploitation can result in arbitrary code execution as the web server user. The described technique writes attacker-controlled PHP content to a web-accessible path, enabling remote code execution.
Which ILIAS releases need to be remediated?
Versions before 9.22, 10.10, and 11.3 are affected. Upgrade to the applicable listed release or a later release.