CVE-2026-110761 in ILIAS
Summary
by MITRE • 10/14/2026
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical security flaw within the ILIAS learning management system, specifically affecting versions prior to 9.24, 10.12, and 11.5. This issue is classified as a PHP Object Injection vulnerability, which stems from the unsafe deserialization of user-supplied data. The root cause lies in the application's handling of test archives during creation or import processes. When an authenticated user with specific permissions to create or import tests submits a crafted archive file, the system attempts to parse its contents without sufficient validation or sanitization of internal object structures. This lack of rigorous input verification allows attackers to manipulate the deserialization process by injecting malicious payloads into the tst_sequence attribute, which is subsequently passed directly to PHP's unserialize function.
From a technical perspective, this vulnerability exploits the inherent risks associated with untrusted data being processed through serialization mechanisms. By crafting a test archive that contains a specially designed serialized object within the sequence attributes, an attacker can trigger the instantiation of arbitrary classes during the deserialization phase. The exploit leverages known gadget chains from popular PHP libraries such as Guzzle and Monolog. These libraries contain specific class methods whose side effects can be chained together to achieve remote code execution. For instance, certain methods in these libraries may allow for file system operations or command execution when invoked with controlled parameters. Consequently, the attacker does not need direct access to shell commands but instead manipulates the application's internal logic through object properties and method calls embedded within the serialized payload.
The operational impact of this vulnerability is severe, as it effectively grants an authenticated user full remote code execution capabilities on the server hosting ILIAS. Once the malicious objects are deserialized and executed via the gadget chains, the attacker can write arbitrary PHP files to the web root or other accessible directories. This capability allows for persistent backdoors, data exfiltration, or complete compromise of the underlying infrastructure. Since the vulnerability requires authentication but only demands relatively low-level permissions such as test creation or import rights, it is particularly dangerous in educational environments where many users may have these privileges by default to facilitate course management and assessment activities. The ability to execute arbitrary code means that attackers can escalate their access further, potentially compromising other systems on the same network segment or stealing sensitive student and institutional data stored within the database.
This vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data, a category of flaws where applications fail to validate or verify data before deserializing it, leading to potential remote code execution or denial of service. In terms of offensive security frameworks, this attack vector corresponds to ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques like T1059.004 for Unix Shell or T1059.007 for PowerShell, depending on the server environment, as well as T1203 for Exploitation for Client Execution if targeting client-side components, though here it is primarily about server-side execution via file write and include mechanisms. The use of gadget chains from third-party libraries highlights the importance of supply chain security and the need to keep dependencies updated, although in this case, the core issue remains the unsafe deserialization practice within ILIAS itself rather than a flaw in Guzzle or Monolog directly.
Mitigation strategies must focus on immediate patching and architectural changes to prevent similar occurrences. The primary remediation is to upgrade ILIAS to version 9.24, 10.12, or 11.5 or later, where the developers have addressed this specific deserialization flaw by implementing stricter validation of serialized data structures before they are processed. Additionally, administrators should enforce the principle of least privilege by restricting test creation and import permissions to only those users who absolutely require them for their roles. Implementing Web Application Firewalls with rules capable of detecting anomalous serialization patterns or known gadget chain signatures can provide an additional layer of defense in depth. Furthermore, enabling PHP configuration settings such as disable_functions to restrict dangerous functions like eval, exec, and system can limit the impact if a deserialization attempt succeeds. Regular security audits and code reviews focusing on input validation for all data entering critical parsing routines are essential to maintaining long-term resilience against object injection attacks.