CVE-2026-80428

Name of the Vulnerable Software and Affected Versions ILIAS (affected versions not specified)

Description An unauthenticated caller can trigger the deserialization of stored session data. The Shibboleth back-channel endpoint 'components/ILIAS/AuthShibboleth/resources/shib logout.php' operates in a context exempt from authentication. Its logout-notification handler iterates through all live rows of the session table and passes the stored data to a parser that uses unserialize without restricting class construction. This allows serialized objects to be instantiated during an anonymous request, triggering object destructors upon disposal. An attacker can inject a serialized object into a session row via the LTI authentication entry point, which stores request parameters into the session and is also exempt from authentication. By leveraging a bundled class that writes JSON-encoded structures to a file based on its own properties during destruction, an attacker can place controlled content at a chosen path below the web root, leading to remote code execution as the web server user.

Recommendations Update to version 9.22, 10.10, or 11.3 to remove the vulnerable logout-notification implementation.