LIMESURVEY · CVE-2026-115640 · Package
FIX → 7.9.0+261029 ✓ verified
LimeSurvey Community Edition 7.7.0 stores HTML from a participant_id field in a CSV import without validation, then renders it unescaped in the Central Participants Database list. When a CPDB editor opens that list, the attacker's script runs inside their logged-in LimeSurvey session and can make same-origin requests with their permissions.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted LimeSurvey installs (Community Edition 3.0.0 to 7.7.0 per the maintainer) that use the Central Participants Database. A user with only the permission to import participants can plant HTML in a participant ID that runs as script in any administrator's browser who opens the participant list. Installs that do not use CPDB or have no untrusted users with import permission are at much lower risk.
Not affected if no-cpdb, no-cpdb-usage, no-untrusted-import-users
Who cares limesurvey, php, self-hosted, stored-xss, xss
3.0.0 to 7.7.0 are affected per the maintainer; if you are on 7.8.x or older than 7.9.0+261029, upgradeLimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 7.9.0+261029
Upgrade to LimeSurvey 7.9.0+261029 (contains commit 4cd2818).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.