The vulnerability is a PHP object injection flaw that permits authenticated users with permission to create or import tests to deserialize crafted test archives. Deserialization of an arbitrary tst_sequence sequence attribute leads to the creation of objects that are passed to PHP’s unserialize() function. This can be exploited by an adversary to trigger gadget chains in Guzzle or Monolog, enabling the arbitrary writing of PHP files to the server and executing malicious code. The attack, when successful, compromises confidentiality, integrity, and availability of the affected system.

The issue affects the ILIAS e-learning platform from the ILIAS-eLearning e.V. organization. Versions older than 9.24, 10.12, and 11.5 are vulnerable, while later releases contain the patch.

With a CVSS score of 8.7 the flaw is treated as severe. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker be authenticated and hold test creation or import rights, yet the described gadget chains enable attacker‑controlled file creation and code execution. Because the vector involves legitimate administrative actions, the likelihood of exploitation is considered significant for environments where test import functionality is enabled.