ILIAS Unauthenticated PHP Object Injection via Shibboleth Logout Handler (CVE-2026-80428)

Technical Analysis

The flaw chains two unauthenticated code paths exempted by ilInitialisation: the LTI authentication entry point, which writes attacker-supplied request parameters into session storage, and the Shibboleth back-channel logout handler (shib_logout.php), which iterates all live session rows and calls unserialize() on their contents without class whitelisting (PHP Object Injection, CWE-502). A bundled application class implements a destructor (__destruct) that writes attacker-controlled JSON content to a file path derived from one of its own object properties, enabling arbitrary file write below the web root and subsequent PHP code execution as the web server user — effectively a POP (property-oriented programming) gadget chain triggered without authentication. This is rated critical (CVSS 9.8) as it requires no credentials, no user interaction, and yields full remote code execution; organizations running ILIAS instances that also host or orchestrate AI agent tooling (e.g., RAG pipelines indexing course content, LLM-based tutoring plugins, or automation agents with filesystem/API access on the same host) risk credential and API key theft, agent config tampering, or pivoting into agent infrastructure once the web server is compromised.

Affected Systems

ILIAS LMS versions prior to 9.22, 10.10, and 11.3, specifically installations with the Shibboleth authentication module enabled (components/ILIAS/AuthShibboleth/resources/shib_logout.php) and the LTI authentication entry point reachable without prior authentication.

Indicators of Compromise

• components/ILIAS/AuthShibboleth/resources/shib_logout.php
• Anomalous unauthenticated POST/GET requests to shib_logout.php and LTI authentication endpoints
• Unexpected .php or JSON-named files written under web root directories
• Unusual session table entries containing serialized PHP object strings (e.g. O:...:{...})

Remediation Steps

1. 1

   Upgrade ILIAS immediately

   Update to ILIAS 9.22, 10.10, 11.3 or later, which removes the vulnerable logout-notification implementation.

2. 2

   Restrict or disable exposed endpoints

   If immediate patching is not possible, block external/unauthenticated access to shib_logout.php and the LTI authentication entry point at the web server or WAF layer until patched.

3. 3

   Audit and purge session data

   Inspect and clear session storage for suspicious serialized object payloads; rotate session secrets and invalidate all active sessions post-patch.

4. 4

   Filesystem integrity monitoring

   Deploy file integrity monitoring on the web root to detect unauthorized file writes, especially newly created PHP or JSON files outside expected paths.

5. 5

   Review co-hosted agent/API integrations

   For deployments where ILIAS shares infrastructure with AI agent services, RAG connectors, or automation tooling, rotate any API keys/credentials accessible from the web server and audit for lateral movement.