ILIAS EUVD-2026-66602

Exploitation requires that the ILIAS instance expose the Shibboleth back-channel logout endpoint components/ILIAS/AuthShibboleth/resources/shib_logout.php, which is reachable on an ilInitialisation authentication-exempt path in affected versions, and that the attacker be able to place a serialized object into a row of the usr_session table - achievable unauthenticated via the LTI authentication entry point, which stores request parameters into the session on another auth-exempt path. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication or user interaction requirement and the attack works against affected default deployments where these endpoints are present. Limiting factors: the target must be running a vulnerable pre-9.22 / pre-10.10 / pre-11.3 build with the logout-notification code present; a successful file-write-to-RCE outcome depends on the web server user having write access to a location below the web root and the bundled destructor gadget being loadable, and any front-end restriction of the shib_logout.php path or removal of the LTI path defeats the chain.

This is a genuine high-priority issue rather than an inflated CVSS number. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact, and the technical description corroborates every metric: the vulnerable endpoint is explicitly on an authentication-exempt path and the object-seeding LTI path is likewise unauthenticated, so PR:N is credible rather than optimistic. The end state is a file write below the web root that yields code execution as the web server user, which supports the high triple impact. There is no CISA KEV listing and no confirmed public POC, so this is not yet known to be actively exploited; however, the combination of unauthenticated RCE, a self-contained gadget bundled with the product, and a public VulnCheck advisory plus a patch commit that clearly localizes the vulnerable code substantially lowers the barrier to weaponization. Given ILIAS's footprint in the education sector, any operator running an affected version should treat patching as urgent, even a mid-sized university or municipal IT team should prioritize this over most other backlog items. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here.

An anonymous attacker first sends a request to the LTI authentication entry point with crafted parameters, causing ILIAS to store an attacker-supplied serialized gadget object into a live row of the usr_session table without any login. The attacker then issues an unauthenticated POST to shib_logout.php, whose logout-notification handler reads every live session row and unserialize()s the attacker's blob; the gadget's destructor writes attacker-controlled JSON content to a chosen path below the web root, and the attacker requests that dropped file to execute code as the web server user. No public POC is confirmed at time of analysis, and the low attack complexity and network attack vector make the chain straightforward to script once the gadget path is known.