CVE-2025-11345

ILIAS Test Import unserialize deserialization

CVSS 5.1 MEDIUMEPSS 0.3%CWE-20 CWE-502

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Oct 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

Affected products

n/a · ILIAS

References

https://docu.ilias.de/go/blog/15821/882 https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce https://vuldb.com/?ctiid.327230 https://vuldb.com/?id.327230 https://vuldb.com/?submit.664891