Medium severity6.3NVD Advisory· Published Oct 6, 2025· Updated Jun 17, 2026

CVE-2025-11346

Description

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.

Affected products

Ilias/Ilias5 versions
cpe:2.3:a:ilias:ilias:10.1:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:ilias:ilias:10.1:*:*:*:*:*:*:*
- cpe:2.3:a:ilias:ilias:8.23:*:*:*:*:*:*:*
- cpe:2.3:a:ilias:ilias:9.13:*:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: <=8.23, <=9.13, <=10.1

Patches

Vulnerability mechanics

References

vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
wid.cert-bund.de/portal/wid/securityadvisorynvdThird Party Advisory
vuldb.comnvdPermissions RequiredVDB Entry
srlabs.de/blog/breaking-ilias-part-2-three-to-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000