CVE-2026-80428: ILIAS Deserialization RCE Vulnerability

CVE-2026-80428 Overview

CVE-2026-80428 is an unauthenticated PHP object injection vulnerability in the ILIAS eLearning platform. The Shibboleth back-channel logout endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context exempt from authentication. Its logout-notification handler reads every live session row and passes stored data to a hand-written parser that calls unserialize without class allow-listing. Attackers seed a serialised object into a session row through the LTI authentication entry point, which is also authentication-exempt. A bundled class writes attacker-controlled JSON to an attacker-chosen path during destruction, yielding code execution as the web server user. Versions 9.22, 10.10, and 11.3 remove the vulnerable logout-notification implementation.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary code execution on ILIAS servers by writing attacker-controlled content beneath the web root.

Affected Products

ILIAS eLearning versions prior to 9.22
ILIAS eLearning versions prior to 10.10
ILIAS eLearning versions prior to 11.3

Discovery Timeline

2026-08-26 - CVE-2026-80428 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80428

Vulnerability Analysis

The vulnerability is an insecure deserialization flaw classified under [CWE-502]. The Shibboleth back-channel endpoint shib_logout.php executes inside an initialisation context that ilInitialisation marks as exempt from authentication. Its logout-notification handler locates the session to terminate by iterating every live row of the session table. It then passes each row's stored data to a hand-written parser that invokes unserialize on serialised object fragments.

The parser does not restrict which classes may be constructed. Any serialised object present in a session row is instantiated on behalf of the anonymous caller. Object destructors then run when those instantiated objects go out of scope, enabling gadget chains that reach dangerous sinks.

Root Cause

The root cause is a call to unserialize on attacker-influenced data without an allowed_classes restriction. The endpoint's authentication exemption compounds the issue by permitting anonymous callers to trigger the deserialisation path. A bundled gadget class writes a JSON-encoded structure to a filesystem path stored in one of its own properties when destroyed, providing a direct sink for arbitrary file write below the web root.

Attack Vector

An attacker first seeds a crafted serialised object into a session row without authenticating. The LTI authentication entry point stores request parameters into the session and is reachable on an initialisation path that is also exempt from authentication. The attacker then requests shib_logout.php, which iterates session rows and unserialises the planted payload. Destruction of the gadget object writes attacker-controlled JSON to a chosen path below the web root, and a subsequent HTTP request to that path executes code as the web server user.

The vulnerability mechanism is described in the VulnCheck Security Advisory and the fix is available in ILIAS Commit f36934a.

Detection Methods for CVE-2026-80428

Indicators of Compromise

Unauthenticated HTTP requests to components/ILIAS/AuthShibboleth/resources/shib_logout.php, particularly with logout-notification parameters from external IP addresses.
Anonymous requests to LTI authentication endpoints containing unusually long or binary-like request parameters consistent with PHP serialised objects.
New or modified files beneath the ILIAS web root that contain JSON payloads and were created by the web server user without a corresponding administrative action.
Web server processes spawning shells, php, curl, wget, or other interpreters immediately after requests to Shibboleth or LTI endpoints.

Detection Strategies

Inspect HTTP access logs for requests to shib_logout.php and LTI entry points originating from unauthenticated sessions, and correlate with subsequent access to newly created files under the web root.
Alert on POST or GET parameters containing PHP serialisation markers such as O:, s:, or a: on ILIAS endpoints.
Monitor the session table backend for rows written by anonymous sessions that contain serialised object structures.

Monitoring Recommendations

Enable file integrity monitoring on the ILIAS web root and alert on any file creation by the web server user account.
Forward web server, PHP-FPM, and session store logs to a centralised analytics platform and retain them for correlation across the Shibboleth, LTI, and post-exploitation stages.
Track child processes of the web server user and flag execution of shell interpreters or outbound network connections.

How to Mitigate CVE-2026-80428

Immediate Actions Required

Upgrade ILIAS to version 9.22, 10.10, or 11.3, which remove the vulnerable logout-notification implementation.
If patching is delayed, block external access to components/ILIAS/AuthShibboleth/resources/shib_logout.php at the reverse proxy or web server layer.
Review the ILIAS session table for rows containing serialised object markers and terminate anomalous sessions.
Audit the web root for unexpected files created by the web server user and remove any attacker-planted artefacts.

Patch Information

The upstream fix is applied in ILIAS Commit f36934a and included in ILIAS 9.22, 10.10, and 11.3. The patch removes the logout-notification handler that iterated session rows and invoked unserialize. Source is available in the ILIAS eLearning GitHub Repository.

Workarounds

Restrict access to Shibboleth back-channel endpoints to trusted Identity Provider IP ranges only.
Disable the Shibboleth authentication component entirely if it is not in use in the deployment.
Deny anonymous access to the LTI authentication entry point at the web server or WAF layer to prevent serialised payload seeding.

bash

# Example nginx rule to block anonymous access to the vulnerable endpoint
location ~* /components/ILIAS/AuthShibboleth/resources/shib_logout\.php$ {
    allow 10.0.0.0/8;      # trusted IdP range
    deny all;
    return 403;
}