CVE-2025-11345: ILIAS Test Import unserialize deserialization

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-06 · updated 2026-10-19
Weakness: CWE-20

Description

A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.

Affected products

ILIAS: 8.23, 9.13, 10.1

References

https://docu.ilias.de/go/blog/15821/882
https://vuldb.com/?ctiid.327230
https://vuldb.com/?id.327230
https://vuldb.com/?submit.664891
https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce

Get alerted when CVE-2025-11345 or the next vulnerability affects your stack