Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110761: ILIAS test import can let authorized users run code

CVE-2026-110761 · published 4 days ago

Summary

In older versions of ILIAS, a user who is allowed to create or import tests can upload a specially crafted test file that makes the system execute code it should not run. This could let an attacker place and run their own programs on the server. Upgrade to the latest ILIAS release or apply the vendor’s security update to fix the problem.

What to do

Update ilias-elearning e.v. ilias to version 9.24 or later.

Affected software

Vendor	Product	Affected versions
ilias-elearning e.v.	ilias	< 9.24

Original advisory text

ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

References

https://docu.ilias.de/go/blog/15821/952 Vendor Advisory
https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=228077&ref_... Vendor Advisory
https://github.com/ILIAS-eLearning/ILIAS Product
https://github.com/ILIAS-eLearning/ILIAS/commit/cf4e9c230edfd96fc94a1b1d355500aa... Patch
https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146... Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1107... Vendor Advisory
https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146... Third Party Advisory
https://github.com/ILIAS-eLearning/ILIAS/commit/267d4645ea940f8f97d1a9838deff6a1... Patch
https://github.com/ILIAS-eLearning/ILIAS/commit/ac4684239641fb3dab2d636b53a61c46... Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-110761 Vendor Advisory
https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-php-object... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published14 Oct 2026

Updated15 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-110761 · NVD

CVE-2026-110761 · MITRE

CVE-2026-110761 · OSV

Track software like this

Free during beta