A critical deserialization flaw in the ILIAS e-learning platform lets an unauthenticated attacker inject a serialized PHP object into a session row and trigger it through the Shibboleth back-channel logout endpoint, plausibly leading to code execution as the web server user.
What Is It
CVE-2026-80428 is a CWE-502 (deserialization of untrusted data) vulnerability carrying a CVSS 3.1 base score of 9.8 (CRITICAL) and a CVSS 4.0 score of 9.3 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication. Its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row's stored data to a hand-written parser that calls unserialize without restricting which classes may be constructed. Any serialized object sitting in any session row is therefore instantiated on behalf of an anonymous request, and object destructors run when those objects are discarded.
Why It Matters
The attack requires no login at either end of the chain. A serialized object can be planted in a session row without credentials because the LTI authentication entry point stores request parameters into the session and is reachable on a path the same initialisation code exempts from authentication.
A class bundled with the application writes a JSON-encoded structure to a file named by one of its own properties when it is destroyed. That primitive places attacker-controlled content at an attacker-chosen path below the web root; remote, network-reachable, low complexity, no privileges, no user interaction. Whether that file write converts to code execution as the web server user depends on the target's handler configuration and filesystem permissions, but a writable path below the web root is the usual precondition, and the CVSS 3.1 assessment of high impact to confidentiality, integrity and availability reflects that expectation.
No public reporting reviewed for this brief indicates that CVE-2026-80428 is being exploited in the wild, and it does not appear in the sources listed below as a known-exploited vulnerability. Absence of evidence here is not evidence of absence; treat this as unconfirmed rather than ruled out.
What's Vulnerable
ILIAS (ILIAS-eLearning e.V.):
- All versions before 9.22
- 10.0 up to (not including) 10.10
- 11.0 up to (not including) 11.3
Patch Status
Versions 9.22, 10.10 and 11.3 remove the endpoint's logout-notification implementation. Upgrade to the fixed release on your branch. The upstream fix is available in commit f36934a.
Sources
- NVD, CVE-2026-80428 record (source: [email protected]), published 2026-08-26
- VulnCheck Advisory; ILIAS unauthenticated PHP object injection via Shibboleth logout endpoint
- ILIAS-eLearning/ILIAS, fix commit f36934a
- ILIAS-eLearning/ILIAS, project repository