ILIAS LMS EUVD-2026-101561

Exploitation requires an authenticated ILIAS account holding the Test creation or Test import permission (PR:L); it is not reachable by anonymous visitors. The attacker must import a crafted Test results archive whose XML 'sequence' (tst_sequence) attribute contains a malicious PHP serialized object, which pre-patch code passes to unserialize() without allowed_classes restriction (see class.ilTestResultsImportParser.php and class.ilObjTest.php). Successful code execution further depends on the bundled Guzzle or Monolog libraries being present to supply usable POP gadget chains - which they are in standard ILIAS installs. Affected versions are ILIAS before 9.24, 10.12, and 11.5; the required permission and the import-only trigger path are the primary limiting factors on real-world risk.

This is a genuine high-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) combined with full high impact on confidentiality, integrity and availability (VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity flaw that yields remote code execution - the practical worst case for a web application. The one meaningful limiter is PR:L: the attacker must already hold an authenticated account with Test creation or import permission, which is why the score is 8.7 rather than a 9.x unauthenticated critical. This is a CWE-502 deserialization-to-RCE class issue, which historically correlates with real exploitation once gadget chains are public. No EPSS score, KEV listing, or published proof-of-concept was provided in the input, so there is no evidence of active exploitation yet; the signals are not conflicting so much as incomplete. The VulnCheck advisory and three vendor fix commits confirm the bug is real and well-understood, and the diffs explicitly show attacker-controlled data reaching unserialize() - meaning a working exploit is well within reach for a motivated authenticated adversary even though none is confirmed public today.

An attacker who holds (or phishes/registers) an ILIAS account with Test creation or import rights uploads a crafted Test results archive whose XML carries a malicious serialized 'sequence' attribute. When ILIAS imports the archive it passes that value to unserialize() without class restrictions, instantiating a Guzzle or Monolog gadget chain that writes a PHP webshell to disk and executes code in the application context. No public exploit was identified at time of analysis, but the vendor fix commits publicly reveal the vulnerable sink and the required attribute, lowering the barrier to weaponization.