PHP Object Injection Vulnerability in ILIAS Affected by Malicious Test Archive Exploits

CVE-2026-110761

What is CVE-2026-110761?

The ILIAS eLearning platform suffers from a PHP object injection vulnerability that can be exploited by authenticated users possessing Test creation or import permissions. By crafting malicious Test archives, attackers can exploit this weakness to deserialize arbitrary objects, specifically injecting harmful attributes into the tst_sequence sequence. This can lead to arbitrary PHP file creation and code execution, leveraging vulnerabilities in Guzzle or Monolog gadget chains. It is crucial for users of ILIAS to apply updates to versions 9.24, 10.12, or 11.5 or later to mitigate this security threat.

References