CVE-2026-110761
HIGH 8.7ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 47th percentile
Impact if exploited
8.7CVSS 4.0 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-502: Deserialization of Untrusted Data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 8.7 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - HIGH 8.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 8.7 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 8.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Patches & mitigations
- https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=228077&ref_id=35 CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://github.com/ILIAS-eLearning/ILIAS/commit/cf4e9c230edfd96fc94a1b1d355500aa8c6f1771 CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://github.com/ILIAS-eLearning/ILIAS/commit/267d4645ea940f8f97d1a9838deff6a12097564d CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://github.com/ILIAS-eLearning/ILIAS/commit/ac4684239641fb3dab2d636b53a61c46462d1208 CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543
Advisories
- https://docu.ilias.de/go/blog/15821/952 CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-php-object-injection-via-test-results-import CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101561 EUVD · EUVD-2026-101561
Technical & other
- https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilObjTest.php#L7364 CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://github.com/ILIAS-eLearning/ILIAS/blob/2a3758ee3b01e5c66922e08f58a2189146b884d4/components/ILIAS/Test/classes/class.ilTestResultsImportParser.php#L225 CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543 - https://github.com/ILIAS-eLearning/ILIAS CVE record · VulnCheck · Updated 2026-10-14T18:47:35.995Z
NVD · CVE-2026-110761 · Updated 2026-10-14T20:17:31.543