Vulnerability · Published Aug 26, 2026 · Assigned by VulnCheck
CVE-2026-80428ILIAS PHP Object Injection via Shibboleth Logout
Critical 9.8
In plain English
A critical-severity unsafe deserialization in ILIAS from ILIAS-eLearning e.V.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ILIAS-eLearning e.V. | ILIAS | 9.0 – before 9.2210.0 – before 10.1011.0 – before 11.3 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 11.3 Release Notes release-notes
- 11.3 Download patch, product
- 10.10 Release Notes release-notes
- 10.10 Download product, patch
- 9.22 Release Notes release-notes
- 9.22 Download product, patch
- Researcher Advisory technical-description
- Researcher Writeup technical-description, exploit