TI-2025-24280 Aliases CVE-2025-34120 GHSA-66f6-qrfg-wxwr

LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload

HIGH 77CWE-22Published 2025-07-16 · Updated 2025-11-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22, CWE-306 and the CVSS impact.

Summary

An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01989 80th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LimeSurvey	LimeSurvey	2.0+ – 2.06+ Build 151014	—	No fix listed	CNA

LimeSurvey VendorLimeSurvey Affected 2.0+ – 2.06+ Build 151014 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:limesurvey:limesurvey::::::::	—	—	LimeSurvey

cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* Versions — — ·LimeSurvey

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-34120
2026-10-03 Alias added: GHSA-66f6-qrfg-wxwr

References

Exploit 2

Patch 1

https://web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015

Advisory 1

https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/

TI-2020-09194 LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in… CVSS 3.1CRITICAL 9.8
TI-2024-28662 An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers… CVSS 3.1HIGH 8.8
TI-2024-26167 Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
TI-2026-45174 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup CVSS 4.0HIGH 8.5
TI-2026-61986 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings CVSS 4.0HIGH 7.4
TI-2026-45173 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint CVSS 4.0HIGH 7.4

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences