ILIAS allows unauthenticated attackers to inject serialized objects through the LTI authentication endpoint, which are later deserialized by the Shibboleth back‑channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker‑controlled PHP content to a web‑accessible path and achieve remote code execution as the web server user. This provides a full remote code execution vector with no authentication required.

Vendors: ILIAS‑eLearning e.V. product: ILIAS. Versions affected are 9.22, 10.10, and 11.3. Earlier revisions of these releases, and all prior ILIAS versions that include the vulnerable shib_logout.php handler, are also susceptible.

The vulnerability has a CVSS score of 9.3, classifying it as critical. The EPSS score is 0.00517, indicating a very low but nonzero exploitation probability, but the high severity and the attacker’s lack of authentication requirement suggest a significant exploitation risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the Shibboleth logout endpoint, exploiting the unguarded unserialize call to instantiate malicious objects and achieve remote code execution.