LimeSurvey Community Edition: SQL injection via survey archive participant attributes
Summary
LimeSurvey Community Edition 7.8.0 contains an SQL injection flaw in the import of survey archives (.lsa) and the SPSS response export. An authenticated user with the global surveys.create permission can import a crafted archive that creates a participant attribute column with SQL syntax in its name. When responses of the imported non-anonymous survey are exported as SPSS, the database executes this SQL with the privileges of the application's database account, which can expose data beyond the imported survey. Exploitation requires a valid account with survey-creation rights.
Affected
- LimeSurvey Community Edition 7.8.0 (according to the CNA record)
- Versions before 7.8.0 are not reported as affected.
Fixed in
- Unknown. No vendor fix was confirmed at the time of publication.
Workaround
- Limit the global surveys.create permission to trusted administrators.
- Do not import untrusted .lsa survey archives.
- Review imported participant table schemas for unexpected attribute column names.
- Avoid SPSS exports of responses from imported non-anonymous surveys until a fix is available (inference, not a vendor recommendation).
Exploitation
- Not known to be exploited in the wild. The CVE is not listed in CISA KEV.
- Public proof of concept status is conflicting between sources and unresolved.
- The Fluid Attacks advisory states that an exploit is available.
Our recommendation
- Check whether LimeSurvey 7.8.0 is in use, and restrict or review accounts with the surveys.create permission.
- Review recent .lsa survey imports and imported participant attribute columns.
- Apply the vendor fix as soon as it is published and re-check the advisory and LimeSurvey releases regularly.
- Check the whole LimeSurvey deployment, since another SQL injection (CVE-2026-50636) is reported for the RemoteControl API.
- Monitor database and web server logs for unusual export activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fluid Attacks advisory (CNA) fluidattacks.com
- CVE record www.cve.org
- LimeSurvey GitHub repository github.com
- import_helper.php github.com
- export_helper.php github.com
- VulDB entry vuldb.com
- OpenCVE app.opencve.io
- ThreatHackerWire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:03.
Original description (NVD)
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.