CVE-2025-11345CWE-20CWE-502insecure-deserialization

CVE-2025-11345

Medium · published October 6, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2025-10-06T23:15Z
Affected products (3)
ProductVersionsFixed in
ilias/iliasall versions—
ilias/iliasall versions—
ilias/iliasall versions—
References (5)
https://docu.ilias.de/go/blog/15821/882 · [email protected]https://vuldb.com/?ctiid.327230 · [email protected]https://vuldb.com/?id.327230 · [email protected]https://vuldb.com/?submit.664891 · [email protected]https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 OCT 19:02Z
    ILIAS Test Import unserialize deserialization
    cvelistv5