CVE-2026-110761: falha de alta gravidade em ILIAS-eLearning e.V. ILIAS
ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.6%
probabilidade de exploração
0.6%top 54% das CVEs
exploração observada
nãonenhuma fonte reporta
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ILIAS-eLearning e.V. · ILIASCVEs relacionadas — ILIAS-eLearning e.V. ILIAS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-80428CRITICALILIAS PHP Object Injection via Shibboleth LogoutEPSS 4.7%CVE-2026-107639HIGHILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload FilenameEPSS 0.7%CVE-2026-82538HIGHILIAS Arbitrary SQL Injection via Repository Trash Table Sort ParameterEPSS 0.7%CVE-2026-108113HIGHILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI ImportEPSS 0.6%CVE-2026-82877HIGHILIAS Arbitrary File Read via SOAP addFileEPSS 0.5%CVE-2026-86416MEDIUMILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action MethodsEPSS 0.4%
Referências
https://docu.ilias.de/go/blog/15821/952https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=228077&ref_id=35https://github.com/ILIAS-eLearning/ILIAShttps://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilObjTest.php#L7364https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilTestResultsImportParser.php#L225https://github.com/ILIAS-eLearning/ILIAS/commit/267d4645ea940f8f97d1a9838deff6a12097564dhttps://github.com/ILIAS-eLearning/ILIAS/commit/ac4684239641fb3dab2d636b53a61c46462d1208https://github.com/ILIAS-eLearning/ILIAS/commit/cf4e9c230edfd96fc94a1b1d355500aa8c6f1771https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-php-object-injection-via-test-results-import