CVE-2026-80428: ILIAS PHP Object Injection via Shibboleth Logout
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ILIASto a version that resolves this vulnerability.Fixed in 9.22 - Upgrade
Upgrade
ILIASto a version that resolves this vulnerability.Fixed in 10.10 - Upgrade
Upgrade
ILIASto a version that resolves this vulnerability.Fixed in 11.3
Event History
Frequently Asked Questions
Which deployments are exposed?
ILIAS versions before 9.22, 10.10, and 11.3 are affected. The vulnerable Shibboleth back-channel logout endpoint and the LTI authentication entry point are both exempted from authentication by the application initialization code.
Does exploitation require an account or user interaction?
No. The issue is reachable by an unauthenticated caller, and attacker-controlled serialized data can be placed into a session row without logging in through the LTI authentication entry point. No user interaction is required.
What access can successful exploitation provide?
Successful exploitation can result in code execution as the web server user. The described destructor writes attacker-controlled content to an attacker-chosen path below the web root.
What vulnerable behavior should responders investigate?
Investigate unauthenticated requests to the Shibboleth back-channel logout endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php and the LTI authentication entry point. The logout handler processes every live session-table row and unserializes stored session data without restricting constructible classes.