CVE-2026-110761

EUVD-2026-101561
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://docu.ilias.de/go/blog/15821/952
https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=228077&ref_id=35
https://github.com/ILIAS-eLearning/ILIAS
https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilObjTest.php#L7364
https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilTestResultsImportParser.php#L225
https://github.com/ILIAS-eLearning/ILIAS/commit/267d4645ea940f8f97d1a9838deff6a12097564d
https://github.com/ILIAS-eLearning/ILIAS/commit/ac4684239641fb3dab2d636b53a61c46462d1208
https://github.com/ILIAS-eLearning/ILIAS/commit/cf4e9c230edfd96fc94a1b1d355500aa8c6f1771
https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-php-object-injection-via-test-results-import