CVE-2025-11344 is a medium severity (6.3) remote code execution flaw in the ILIAS Certificate Import Handler. ILIAS 8.24, 9.14 and 10.2 fix it. Upgrade any instance on 8.23, 9.13, 10.1 or earlier. ILIAS itself rates the underlying issue higher than the record does.
What's affected
ILIAS lists 8.23, 9.13 and 10.1 as affected for this issue, titled "Certificate: Unauthenticated Remote Code Execution" in its security blog. The fixed versions are 8.24, 9.14 and 10.2.
The record scores it 6.3 (medium). ILIAS gives the same issue a CVSS 4.0 score of 7.7 and credits researchers from SRLabs. Plan around the higher figure if in doubt.
How to check if you're exposed
Read your ILIAS version from the administration area. Anything at or below 8.23, 9.13 or 10.1 is in scope. Also see whether the certificate import is reachable without a login on your instance.
On a source deployment you can confirm the release by looking at the version file or the git tag of the checkout. Ask your hosting provider if you use managed ILIAS.
For the inventory side, the free in-browser scan at gold.safeguard.sh/scan can list packages from a requirements file and show known issues against them.
What to do now
- Upgrade to 8.24, 9.14 or 10.2, whichever matches your line.
- Read the ILIAS security notes for that release. Nine issues were fixed together, including other import and test related problems, so upgrade as one step rather than patching one at a time.
- Until you can upgrade, limit access to the instance, particularly the certificate import functions.
- Take a backup before upgrading and test the certificate features afterwards.
- Review web logs for the period before the upgrade.
Why it matters
The record classes this as CWE-74 (injection), CWE-94 (code injection). The certificate import path accepts input that ends up being run by the server. ILIAS describes the issue as unauthenticated, which is why its own score is higher than the record score.
Learning platforms hold student data and often face the open internet. Nine fixes shipped together, so the upgrade is worth doing even if you decide this single issue is not reachable for you. The record does not mark it as on CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix this?
ILIAS 8.24, 9.14 and 10.2, according to the ILIAS security blog.
Should I wait to upgrade if my instance is internal only?
Not for long. Insider access, VPN users and compromised laptops can still reach it, and the release fixes eight other issues.
Sources
Last reviewed: 19 October 2026.
