Stored Cross-Site Scripting in LimeSurvey Community Edition
CVE-2026-115640

7.4HIGH

Key Information:

Vendor

Limesurvey

Status
Limesurvey Community Edition
Vendor
CVE Published:
10 November 2026

What is CVE-2026-115640?

In LimeSurvey Community Edition 7.7.0, a stored cross-site scripting vulnerability exists within the Central Participants Database blocklist control. An authenticated user with global participantpanel:import permission can exploit this by importing a CSV file containing participant IDs with HTML content. The system does not properly validate or sanitize this input during the import process. As a result, when a CPDB editor accesses the participant list, LimeSurvey improperly includes attributes derived from participant IDs into the application’s interface without encoding, potentially allowing attackers to execute their JavaScript code. This exploitation can lead to unauthorized access to sensitive session data and enable attackers to perform actions on behalf of other users.

Affected Version(s)

LimeSurvey Community Edition Windows 3.0.0 <= 7.7.0

References

https://fluidattacks.com/es/advisories/angel
third-party-advisory
https://github.com/LimeSurvey/LimeSurvey/
product
https://github.com/LimeSurvey/LimeSurvey/commit/4cd281828...
patch

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Miguel GĂłmez
.