Paper/Archive/CVE-2025-11346

CVE-2025-11346

VulDB — ILIAS Base64 Decoding unserialize deserialization

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 39.3.393 × 207.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.

Affected

ProductAffectedFixed inSource

ILIAS8.08.24CNA

ILIAS8.18.24CNA

ILIAS8.28.24CNA

ILIAS8.38.24CNA

ILIAS8.48.24CNA

ILIAS8.58.24CNA

ILIAS8.68.24CNA

ILIAS8.78.24CNA

ILIAS8.88.24CNA

ILIAS8.98.24CNA

ILIAS8.108.24CNA

ILIAS8.118.24CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.327231 refvuldb.com/?ctiid.327231 writeupvuldb.com/?submit.664892 refwid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2113 refsrlabs.de/blog/breaking-ilias-part-2-three-to-rce