Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-80428: ILIAS can run attacker code through logout
CVE-2026-80428 · published 2 months ago
Summary
Versions of ILIAS before 9.22, 10.10 and 11.3 let anyone send specially crafted data to the login system and then trigger it via the Shibboleth logout process. This can cause the web server to execute whatever code the attacker supplies, potentially compromising the whole site. Update ILIAS to the latest patched version as soon as possible and verify that old versions are no longer accessible.
What to do
- Update ilias-elearning e.v. ilias to version 9.22 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ilias-elearning e.v. | ilias | < 9.22 |
Original advisory text
ILIAS PHP Object Injection via Shibboleth Logout
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
References
- https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225630&ref_... Patch
- https://github.com/ILIAS-eLearning/ILIAS/commit/f36934a6f937d0fe837ca6e642986458... patch
- https://www.vulncheck.com/advisories/ilias-before-9.22-10.10-and-11.3-unauthenti... third-party-advisory
- https://github.com/ILIAS-eLearning/ILIAS Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80428... Vendor Advisory
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdCl... Vendor Advisory
- https://schweigertit.de/en/advisories/SIT-2026-002.html Third Party Advisory
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdCl... Vendor Advisory
- https://schweigertit.de/en/writeups/php-object-injection-shibboleth-logout.html Exploit
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdCl... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80428 Vendor Advisory
- https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225631&ref_... Patch
- https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225632&ref_... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published26 Aug 2026
Updated24 Oct 2026
First seen29 Aug 2026
Track software like this
Free during beta