Key points
- The flaw affects ILIAS versions prior to 9.24, 10.12, and 11.5.
- It is rated CVSS 8.7, which classifies it as high severity.
- Attackers need authentication and specific test creation or import permissions.
ILIAS eLearning platforms running versions before 9.24, 10.12, or 11.5 contain a PHP object injection vulnerability. According to the National Vulnerability Database, this flaw allows authenticated users with test creation or import permissions to deserialize arbitrary objects.
In plain English
The issue arises when a user uploads a crafted test archive. The application processes a specific attribute called tst_sequence and passes it to the unserialize function without proper validation. This allows an attacker to inject malicious data into the system.
The background
Attackers can exploit this by using gadget chains from libraries like Guzzle or Monolog. These chains enable the injection of malicious code that results in writing PHP files to the server. Once the file is written, the attacker can execute arbitrary code on the system.
What changes now
Security teams must identify which ILIAS versions are currently deployed. If an organization runs any version older than 9.24, 10.12, or 11.5, it is exposed to this risk. The source material lists these versions as affected, implying that updates to 9.24, 10.12, or 11.5 resolve the issue.
Who needs to act first
Teams should prioritize updating systems that are exposed to external users or those with broad test creation permissions. Before applying any changes, verify that backups are current and test the update in a staging environment. If a fix is not yet available, restrict access to test import features for non-administrative users to reduce the attack surface immediately.
What to do and how to stay safe: ILIAS
- Inventory all ILIAS instances to determine if they run versions prior to 9.24, 10.12, or 11.5.
- Monitor web server logs for unusual file creation attempts or unexpected PHP script executions.
- Restrict test creation and import permissions to only those users who absolutely require them.
- Watch for official vendor announcements regarding patches for affected versions.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-110761?
The National Vulnerability Database rates this vulnerability as CVSS 8.7, which is classified as high severity.
Which ILIAS versions are affected by this object injection flaw?
The flaw affects ILIAS versions before 9.24, before 10.12, and before 11.5.
What permissions does an attacker need to exploit this vulnerability?
An attacker must be an authenticated user with test creation or import permission to exploit this flaw.
