CVE-2025-11346
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-11346
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11346.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-11346
- Published
- 2025-10-06T20:15:35.313Z
- Modified
- 2025-11-20T12:32:56.547190Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.
- References
Affected packages
Git / github.com/ilias-elearning/ilias
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ilias-elearning/ilias
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affected
Affected versions
4.*
4.3.9
4.4.4
4.4.5
4.4.6
4.4.7
5.*
5.0.0
5.0.0_beta2
v10.*
v10.0
v10.0_beta1
v10.0_beta2
v10.0_beta3
v10.1
v5.*
v5.1.0
v5.1.0beta1
v5.1.0beta2
v5.2.0
v5.2.0beta1
v5.3.0beta1
v5.3.0beta2
v8.*
v8.0_beta1
v8.0_beta2
v8.0_beta3
v8.0_beta4
v8.1
v8.10
v8.11
v8.12
v8.13
v8.14
v8.15
v8.16
v8.17
v8.18
v8.19
v8.2
v8.20
v8.21
v8.22
v8.23
v8.3
v8.4
v8.5
v8.6
v8.7
v8.8
v8.9
v9.*
v9.0
v9.0_beta1
v9.0_beta2
v9.0_beta3
v9.1
v9.10
v9.12
v9.13
v9.2
v9.3
v9.4
v9.5
v9.6
v9.7
v9.8
v9.9