All vulnerabilities
CVE-2026-110761

ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

ILIAS-eLearning e.V. ILIAS
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.24Also 10.12, 11.5CVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

Text from CVE List

Affected versions 3

  • ILIASaffected: 9.0 before 9.24CVE List
  • ILIASaffected: 10.0 before 10.12CVE List
  • ILIASaffected: 11.0 before 11.5CVE List

References 9