CVE-2025-11345 is a Medium severity (CVSS 5.5) deserialization flaw in the Test Import component of the ILIAS learning management system. ILIAS 8.23, 9.13, 10.1 and earlier are affected. The record says upgrading to 8.24, 9.14 or 10.2 resolves it, and later releases are the safer target.
What's affected
The record lists ILIAS up to 8.23, 9.13 and 10.1. The flaw is in a call to PHP's unserialize function inside the Test Import component, which the record says can be reached remotely. The weakness types are CWE-20 (improper input validation) and CWE-502 (deserialization of untrusted data).
The ILIAS security blog entry for release 10.2 gives the fixed versions as 8.24, 9.14 and 10.2, and says the same release closed several other issues, including an unauthenticated problem in the certificate feature.
The researchers who found the issue, SRLabs, add that a bypass of an earlier fix turned up afterwards. They list patch releases 8.25, 9.15 and 10.3, dated 23 September 2025. So do not stop at the first fixed version. Move to the current release in your line.
The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. In plain terms, it is reachable over the network by a logged in user and needs some user interaction. SRLabs describe the real impact for an authorized user who can reach the feature as complete server compromise, so treat the score as a floor rather than a ceiling.
How to check if you're exposed
Open the ILIAS administration area and read the installed version, or check the release you deployed. If you run from a git checkout, git describe prints the nearest tag.
Anything at or below 8.23, 9.13 or 10.1 is in the affected range. At 8.24, 9.14 or 10.2 you have the fix named in the record but not the later patches the researchers mention.
Then ask who holds the permission that reaches this code path. Importing tests means uploading an archive. SRLabs say this is typically open to course administrators or similar roles, so make a list of who holds those roles.
Review web server logs for unusual requests to the feature and unexpectedly large values in request parameters. Logs often miss request bodies, so a clean result is not proof of safety.
What to do now
- List every ILIAS installation you run, including staging and training copies.
- Upgrade to the newest release in your line, and at least 8.25, 9.15 or 10.3.
- Trim the roles and accounts with elevated rights, since the flaw needs a logged in user.
- Review logs from the period you ran an affected version.
- Follow the ILIAS security blog so you see the next batch of fixes.
Why it matters
Deserialization rebuilds live objects from text or bytes the application receives. When the sender controls that data, the objects it builds can trigger behavior the developer never intended. The class is well known and the usual cure is to stop deserializing client supplied data, or to restrict which classes may be built.
A Medium score can hide a serious outcome. If an ordinary account can reach code execution, real risk depends on who holds accounts. Public sign up or a large user base raises it. A learning platform also holds student records and often sits on a public network. The record does not list this CVE in the CISA KEV catalog, and the pages I read do not report attacks. A related issue, CVE-2025-11346, was fixed in the same releases: a second authenticated deserialization problem that works through a request parameter rather than an uploaded file.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-11345 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the pages I read do not report attacks. Check the advisory again before you set the urgency.
Does upgrading to 8.24, 9.14 or 10.2 fully fix it?
Those are the versions the vendor lists as fixed. The researchers describe a follow up bypass fixed in 8.25, 9.15 and 10.3, so go past the first fixed version.
Sources
- ILIAS security blog entry for 10.2
- SRLabs write up, Breaking ILIAS part 2
- NVD record for CVE-2025-11345 (description, CVSS vector, CWEs)
For a quick look at the open source libraries in your own projects, try the free in-browser dependency scan.
Last reviewed: 19 October 2026.
