Exploit for CVE-2026-80428

!CVEhttps://img.shields.io/badge/CVE-2026--80428-red?style=fo...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...