CVE-2025-11346CWE-20CWE-502insecure-deserialization

CVE-2025-11346

Medium · published October 7, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2025-10-07T00:15Z
Affected products (3)
ProductVersionsFixed in
ilias/iliasall versions—
ilias/iliasall versions—
ilias/iliasall versions—
References (5)
https://vuldb.com/?ctiid.327231 · [email protected]https://vuldb.com/?id.327231 · [email protected]https://vuldb.com/?submit.664892 · [email protected]https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2113 · [email protected]https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 OCT 19:32Z
    ILIAS Base64 Decoding unserialize deserialization
    cvelistv5