ILIAS PHP Object Injection via Shibboleth Logout
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
CVE-2026-80428
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80428
ILIAS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/ILIAS-eLearning/ILIAS",
"vendor": "ILIAS-eLearning e.V.",
"product": "ILIAS",
"versions": [
{
"status": "affected",
"version": "9.0",
"lessThan": "9.22",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.0",
"lessThan": "10.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "11.0",
"lessThan": "11.3",
"versionType": "custom"
}
],
"packageURL": "pkg:github/ILIAS-eLearning/ILIAS",
"collectionURL": "https://github.com/ILIAS-eLearning/ILIAS",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-80428
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #4615 · Revision 1
- Added to Heist Feed
- Publisher date