TI-2026-55506 Aliases CVE-2026-80428 GHSA-6h76-35rh-gxm9

ILIAS PHP Object Injection via Shibboleth Logout

MEDIUM 56CWE-502Published 2026-08-26 · Updated 2026-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.04666 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed ILIAS (ILIAS-eLearning e.V.): 9.22, 10.10, 11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ILIAS-eLearning e.V.	ILIAS	9.0 to before 9.22; 10.0 to before 10.10; 11.0 to before 11.3	9.22, 10.10, 11.3	Patch available	CNA

ILIAS VendorILIAS-eLearning e.V. Affected 9.0 to before 9.22; 10.0 to before 10.10; 11.0 to before 11.3 Fixed in 9.22, 10.10, 11.3 Patch available CNA

Remediation

Fix · CNA ILIAS (ILIAS-eLearning e.V.) Fixed in 9.22, 10.10, 11.3

Timeline

2026-10-02 Threatist record created from CVE-2026-80428
2026-10-03 Alias added: GHSA-6h76-35rh-gxm9

References

Exploit 1

Researcher Writeup

Patch 3

Other 4

TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run code CVSS 4.0HIGH 8.7
TI-2026-69589 Argument injection in ILIAS image map uploads enables code execution CVSS 4.0HIGH 8.7
TI-2026-56895 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter CVSS 4.0HIGH 8.7
TI-2026-74420 PHP object injection in ILIAS test results import CVSS 4.0HIGH 8.7
TI-2026-57181 ILIAS Arbitrary File Read via SOAP addFile CVSS 4.0HIGH 7.1
TI-2026-59124 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences