{"id":"CVE-2025-11344","summary":"ILIAS Certificate Import code injection","details":"A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgrading to version 8.24, 9.14 and 10.2 addresses this issue. It is recommended to upgrade the affected component.","modified":"2026-08-12T03:51:45.686410597Z","published":"2025-10-06T18:32:05.924Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11344.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.3"},{"last_affected":"8.3"},{"introduced":"8.4"},{"last_affected":"8.4"},{"introduced":"8.5"},{"last_affected":"8.5"},{"introduced":"8.6"},{"last_affected":"8.6"},{"introduced":"8.7"},{"last_affected":"8.7"},{"introduced":"8.8"},{"last_affected":"8.8"},{"introduced":"8.9"},{"last_affected":"8.9"},{"introduced":"8.10"},{"last_affected":"8.10"},{"introduced":"8.11"},{"last_affected":"8.11"},{"introduced":"8.12"},{"last_affected":"8.12"},{"introduced":"8.13"},{"last_affected":"8.13"},{"introduced":"8.14"},{"last_affected":"8.14"},{"introduced":"8.15"},{"last_affected":"8.15"},{"introduced":"8.16"},{"last_affected":"8.16"},{"introduced":"8.17"},{"last_affected":"8.17"},{"introduced":"8.18"},{"last_affected":"8.18"},{"introduced":"8.19"},{"last_affected":"8.19"},{"introduced":"8.20"},{"last_affected":"8.20"},{"introduced":"8.21"},{"last_affected":"8.21"},{"introduced":"8.22"},{"last_affected":"8.22"},{"introduced":"8.23"},{"last_affected":"8.23"},{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"9.1"},{"last_affected":"9.1"},{"introduced":"9.2"},{"last_affected":"9.2"},{"introduced":"9.3"},{"last_affected":"9.3"},{"introduced":"9.4"},{"last_affected":"9.4"},{"introduced":"9.5"},{"last_affected":"9.5"},{"introduced":"9.6"},{"last_affected":"9.6"},{"introduced":"9.7"},{"last_affected":"9.7"},{"introduced":"9.8"},{"last_affected":"9.8"},{"introduced":"9.9"},{"last_affected":"9.9"},{"introduced":"9.10"},{"last_affected":"9.10"},{"introduced":"9.11"},{"last_affected":"9.11"},{"introduced":"9.12"},{"last_affected":"9.12"},{"introduced":"9.13"},{"last_affected":"9.13"},{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"10.1"},{"last_affected":"10.1"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11344.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11344"},{"type":"ADVISORY","url":"https://vuldb.com/?id.327229"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.664889"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.327229"},{"type":"ARTICLE","url":"https://docu.ilias.de/go/blog/15821/882"},{"type":"ARTICLE","url":"https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ilias-elearning/ilias","events":[{"introduced":"8cb5f0e4c6cc9fd49d7696a72237fb3085010be1"},{"last_affected":"49b6f50999d52993bd1d753b1136f4499cce4f4e"}],"database_specific":{"extracted_events":[{"introduced":"8.23"},{"last_affected":"8.23"},{"introduced":"9.13"},{"last_affected":"9.13"},{"introduced":"10.1"},{"last_affected":"10.1"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:ilias:ilias:8.23:*:*:*:*:*:*:*","cpe:2.3:a:ilias:ilias:9.13:*:*:*:*:*:*:*","cpe:2.3:a:ilias:ilias:10.1:*:*:*:*:*:*:*"]}}],"versions":["10.1","8.23","9.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11344.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}