CVE-2025-11346: Medium Deserialization Flaw in ILIAS Base64 Handler

CVE-2025-11346 is a Medium severity (CVSS 6.3) deserialization flaw in the Base64 Decoding Handler of the ILIAS learning management system. ILIAS 8.23, 9.13, 10.1 and earlier are affected. The record says upgrading to 8.24, 9.14 or 10.2 resolves it, and later releases are the safer target.

What's affected

The record lists ILIAS up to 8.23, 9.13 and 10.1. The flaw is in a call to PHP's unserialize function in the Base64 Decoding Handler, reached through the f_settings argument, and the record says it can be launched remotely. The weakness types are CWE-20 (improper input validation) and CWE-502 (deserialization of untrusted data).

The ILIAS security blog entry for release 10.2 gives the fixed versions as 8.24, 9.14 and 10.2, and says the same release closed several other issues, including an unauthenticated problem in the certificate feature.

The researchers who found the issue, SRLabs, add that a bypass of an earlier fix turned up afterwards. They list patch releases 8.25, 9.15 and 10.3, dated 23 September 2025. So do not stop at the first fixed version. Move to the current release in your line.

The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms, it is reachable over the network by a logged in user and needs some user interaction. SRLabs describe the real impact for an authorized user who can reach the feature as complete server compromise, so treat the score as a floor rather than a ceiling.

How to check if you're exposed

Open the ILIAS administration area and read the installed version, or check the release you deployed. If you run from a git checkout, git describe prints the nearest tag.

Anything at or below 8.23, 9.13 or 10.1 is in the affected range. At 8.24, 9.14 or 10.2 you have the fix named in the record but not the later patches the researchers mention.

Then ask who holds the permission that reaches this code path. SRLabs say authorized users, often without full administrator rights, can reach it, so count every account that can log in.

Review web server logs for unusual requests to the feature and unexpectedly large values in request parameters. Logs often miss request bodies, so a clean result is not proof of safety.

What to do now

1. List every ILIAS installation you run, including staging and training copies.
2. Upgrade to the newest release in your line, and at least 8.25, 9.15 or 10.3.
3. Trim the roles and accounts with elevated rights, since the flaw needs a logged in user.
4. Review logs from the period you ran an affected version.
5. Follow the ILIAS security blog so you see the next batch of fixes.

Why it matters

Deserialization rebuilds live objects from text or bytes the application receives. When the sender controls that data, the objects it builds can trigger behavior the developer never intended. The class is well known and the usual cure is to stop deserializing client supplied data, or to restrict which classes may be built.

A Medium score can hide a serious outcome. If an ordinary account can reach code execution, real risk depends on who holds accounts. Public sign up or a large user base raises it. A learning platform also holds student records and often sits on a public network. The record does not list this CVE in the CISA KEV catalog, and the pages I read do not report attacks. A related issue, CVE-2025-11345, was fixed in the same releases: an authenticated deserialization problem in the test import feature.

Quick check

Sources

• ILIAS security blog entry for 10.2
• SRLabs write up, Breaking ILIAS part 2
• NVD record for CVE-2025-11346 (description, CVSS vector, CWEs)

For a quick look at the open source libraries in your own projects, try the free in-browser dependency scan.

Last reviewed: 19 October 2026.