Unauthenticated PHP Object Injection in ILIAS by ILIAS eLearning

CVE-2026-80428

What is CVE-2026-80428?

The vulnerability in ILIAS allows an unauthenticated attacker to exploit the Shibboleth logout endpoint, enabling the daserialization of session data. This endpoint lacks proper authentication controls, allowing attackers to craft serialized object data that could lead to arbitrary PHP code execution. By leveraging this vulnerability, an attacker can manipulate session data stored in the database and invoke object destructors which execute code in the context of the web server user. The flaw has been addressed in ILIAS versions 9.22, 10.10, and 11.3, which removed the insecure logout-notification handler.

References