CVE-2025-11346

MEDIUM

ILIAS <8.23/9.13/10.1 - Deserialization

Title source: llm

Description

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.

References (5)

Scores

CVSS v3 6.3
EPSS 0.0005
EPSS Percentile 16.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE
CWE-502 CWE-20
Status published

Affected Products (3)

ilias/ilias
ilias/ilias
ilias/ilias

Timeline

Published Oct 06, 2025
Tracked Since Feb 18, 2026