CVE-2026-110761
CVE-2026-110761 · ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
CVSS 8.7 · Hoch · EPSS 0,6% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
ilias
- Softwareversionen
- ≥ 9.0, < 9.24: Betroffen (custom)
- ≥ 10.0, < 10.12: Betroffen (custom)
- ≥ 11.0, < 11.5: Betroffen (custom)
Auf 10.12 aktualisieren; Auf 11.5 aktualisieren; Auf 9.24 aktualisieren
Originalquellen
- https://docu.ilias.de/go/blog/15821/952
- https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=228077&ref_id=35
- https://github.com/ILIAS-eLearning/ILIAS/commit/cf4e9c230edfd96fc94a1b1d355500aa8c6f1771
- https://github.com/ILIAS-eLearning/ILIAS/commit/267d4645ea940f8f97d1a9838deff6a12097564d
- https://github.com/ILIAS-eLearning/ILIAS/commit/ac4684239641fb3dab2d636b53a61c46462d1208
- https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilObjTest.php#L7364
- https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilTestResultsImportParser.php#L225
- https://github.com/ILIAS-eLearning/ILIAS
- https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-php-object-injection-via-test-results-import
- https://nvd.nist.gov/vuln/detail/CVE-2026-110761