Executive brief
ILIAS is a widely-used open-source learning management system. This vulnerability allows attackers without credentials to inject malicious code into ILIAS through its LTI (Learning Tools Interoperability) authentication and Shibboleth logout features, leading to complete compromise of the server and potential exposure of all student and course data.
Technical details
The vulnerability is a PHP object injection flaw in ILIAS's LTI authentication endpoint combined with unsafe deserialization in the Shibboleth back-channel logout handler. An unauthenticated attacker can write serialized gadget objects into session storage via the LTI endpoint, then trigger deserialization through the logout endpoint without authentication checks. By chaining available PHP object gadgets, the attacker achieves arbitrary file write on the web-accessible filesystem, leading to remote code execution as the web server user. No authentication is required; only network access to the vulnerable endpoints is needed.
Affected products
- ILIAS ILIAS before 9.22, 10.10, and 11.3
Timeline
- 2026-08-26: disclosed