Read the docs
TI-2026-45056 Aliases CVE-2026-63107GHSA-34qp-wv4h-827h

LimeSurvey SSRF via REST API Survey Template Host Header

Priority MEDIUM 61CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LimeSurveyLimeSurveyup to 6.17.10; up to 7.0.4—No fix listedCNA
  • LimeSurvey VendorLimeSurvey Affected up to 6.17.10; up to 7.0.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*——LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* Versions — — ·LimeSurvey

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63107
  2. 2026-10-03 Alias added: GHSA-34qp-wv4h-827h

References

Exploit 1

  • TI-2020-09194 LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2025-24280 LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload CVSS 4.0HIGH 8.7
  • TI-2024-28662 An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers… CVSS 3.1HIGH 8.8
  • TI-2024-26167 Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
  • TI-2026-45174 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup CVSS 4.0HIGH 8.5
  • TI-2026-61986 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings CVSS 4.0HIGH 7.4
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences