CVE-2026-110761 Details
Description
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
A PHP object injection vulnerability has been identified in ILIAS versions prior to 9.24, as well as in versions 10.12 and 11.5. This vulnerability allows authenticated users with permissions to create or import tests to deserialize arbitrary objects from manipulated test archives. Exploitation involves injecting a malicious 'tst_sequence' attribute, which is then passed to the 'unserialize()' function. This exploitation can leverage Guzzle or Monolog gadget chains to write PHP files and execute code.
Users can update to ILIAS versions 9.24, 10.12, or 11.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ILIAS | >= 9.0, < 9.24 >= 10.0, < 10.12 >= 11.0, < 11.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |