Read the docs
TI-2025-27426 Aliases CVE-2025-41076GHSA-3q6j-5f25-xfc9

Multiple vulnerabilities in Limesurvey

Priority LOW 36CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-209.

Summary

In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LimeSurveyLimeSurvey6.13.0—No fix listedCNA
  • LimeSurvey VendorLimeSurvey Affected 6.13.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:limesurvey:limesurvey:6.13.0:*:*:*:*:*:*:*6.13.0VulnerableLimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:6.13.0:*:*:*:*:*:*:* Versions 6.13.0 Vulnerable ·LimeSurvey

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41076
  2. 2026-10-03 Alias added: GHSA-3q6j-5f25-xfc9

References

Advisory 1

  • TI-2020-09194 LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2024-28662 An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers… CVSS 3.1HIGH 8.8
  • TI-2024-26167 Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
  • TI-2022-21122 LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the… CVSS 3.1HIGH 7.2
  • TI-2007-03523 Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor)… CVSS 2.0MEDIUM 6.8
  • TI-2018-12189 An issue was discovered in TCPDF before 6.2.22. CVSS 3.0CRITICAL 9.8
See all 81 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences