SQL Injection Vulnerability in LimeSurvey Community Edition
CVE-2026-116645

7.1HIGH

Key Information:

Vendor

Limesurvey

Status
Limesurvey Community Edition
Vendor
CVE Published:
11 November 2026

What is CVE-2026-116645?

LimeSurvey Community Edition 7.8.0 harbors an SQL injection vulnerability within the participant import and SPSS response export features. An attacker with the global surveys.create permission can manipulate a crafted .lsa archive to create an attacker-defined attribute column in the participant XML. When exporting responses from a non-anonymous survey, LimeSurvey improperly injects this persisted attribute name into SQL queries, treating it as an executable expression rather than a safe identifier. This flaw allows for the execution of arbitrary SQL commands with the privileges of the application’s database, potentially compromising sensitive data.

Affected Version(s)

LimeSurvey Community Edition Windows 7.8.0

References

https://fluidattacks.com/es/advisories/pantera
third-party-advisory
https://github.com/LimeSurvey/LimeSurvey/
product
https://github.com/LimeSurvey/LimeSurvey/blob/master/appl...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Miguel GĂłmez
.