{"id":"CVE-2026-115640","kind":"vulnerability","aliases":["CVE-2026-115640"],"related":[],"title":"LimeSurvey: stored XSS via CSV participant import runs in admin sessions","description":"LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.","summary":"LimeSurvey Community Edition 7.7.0 stores HTML from a participant_id field in a CSV import without validation, then renders it unescaped in the Central Participants Database list. When a CPDB editor opens that list, the attacker's script runs inside their logged-in LimeSurvey session and can make same-origin requests with their permissions.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"limesurvey","fixed":["7.9.0+261029"],"affected":">= 3.0.0, <= 7.7.0","ecosystem":"packagist"}],"ecosystems":[],"tags":["limesurvey","package","php","self-hosted","stored-xss","xss"],"not_affected_if":["no-cpdb","no-cpdb-usage","no-untrusted-import-users"],"how_to_check":"Check your version in the admin footer or application/config/version.php. Versions 3.0.0 to 7.7.0 are affected per the maintainer; if you are on 7.8.x or older than 7.9.0+261029, upgrade. Also review Central Participants Database for participant IDs containing HTML such as <script or onerror=, and see who holds the CPDB import permission.","fix":"Upgrade to LimeSurvey 7.9.0+261029 (contains commit 4cd2818).","status":"open","published_at":"2026-11-10T05:17:47+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:18+00:00","updated_at":"2026-11-10T05:23:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T05:22:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"LimeSurvey: stored XSS via CSV participant import runs in admin sessions","impact":"medium","summary":"LimeSurvey Community Edition 7.7.0 stores HTML from a participant_id field in a CSV import without validation, then renders it unescaped in the Central Participants Database list. When a CPDB editor opens that list, the attacker's script runs inside their logged-in LimeSurvey session and can make same-origin requests with their permissions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["limesurvey","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker script runs in editor session, reads session data","analyst_note":"Confirm the fixed version and the patch contents from the linked github.com patch and release notes; the sources given do not state a version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-cpdb-usage","no-untrusted-import-users"],"who_is_affected":"Teams running LimeSurvey Community Edition 7.7.0 with the Central Participants Database feature in use. Exposure needs an account with the participantpanel:import permission and a CPDB editor who views the participant list. Installs without the CPDB feature or without such users are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4705,"output_tokens":525,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch contents from the linked github.com patch and release notes; the sources given do not state a version.","search":"'-115640':14A,17A '-2026':13A,16A '7.7.0':32B,88C 'access':170C 'admin':10A 'attack':64B,156C 'attacker-control':155C 'attribut':144C 'authent':105C,165C 'blocklist':102C 'buttongroupwidget':140C 'caus':154C 'central':52B,99C 'communiti':30B,86C 'contain':89C,119C 'control':103C,157C 'cpdb':58B,132C 'cross':93C 'cross-sit':92C 'csv':5A,42B,116C 'cve':12A,15A 'data':174C 'databas':54B,101C 'deriv':139C 'edit':31B,87C 'editor':59B,133C 'effect':185C 'encod':153C 'execut':160C 'exploit':168C 'expos':173C 'field':39B 'flow':123C 'global':109C 'host':24B 'html':34B,120C,152C 'id':38B,118C,141C,147C 'import':7A,43B,111C,114C,122C 'insert':149C 'insid':68B 'issu':176C 'limesurvey':1A,18A,19B,29B,73B,85C,138C,166C 'list':55B,62B,137C 'log':71B 'logged-in':70B 'make':77B 'markup':158C 'model':128C 'name':143C 'open':60B,134C 'origin':80B,167C,179C 'packag':20B 'particip':6A,37B,53B,100C,117C,136C,146C 'participantpanel':110C 'permiss':84B,112C,186C 'persist':124C 'php':21B 'render':47B 'request':81B,180C 'run':8A,67B 'same-origin':78B,177C 'script':66B,95C 'self':23B 'self-host':22B 'session':11A,74B,172C 'session-expos':171C 'site':94C 'store':2A,26B,33B,91C 'stored-xss':25B 'unescap':49B 'user':106C 'valid':45B,129C 'valu':126C 'via':4A 'victim':163C,183C 'vulner':96C 'without':44B,127C,151C 'xss':3A,27B,28B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted LimeSurvey installs (Community Edition 3.0.0 to 7.7.0 per the maintainer) that use the Central Participants Database. A user with only the permission to import participants can plant HTML in a participant ID that runs as script in any administrator's browser who opens the participant list. Installs that do not use CPDB or have no untrusted users with import permission are at much lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-10T05:23:47Z","by":"analyst","doc":"https://github.com/LimeSurvey/LimeSurvey/commit/4cd281828422abf94468052016eba8897d5ec9aa","run_id":2409}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["limesurvey"],"ptokens":["limesurvey"],"labels":["high","limesurvey","package","php","selfhosted","storedxss","xss"],"campaign_type":null,"search_a":"'-115640':14A,17A '-2026':13A,16A 'admin':10A 'csv':5A 'cve':12A,15A 'import':7A 'limesurvey':1A,18A 'particip':6A 'run':8A 'session':11A 'store':2A 'via':4A 'xss':3A","search_b":"'7.7.0':32B 'attack':64B 'central':52B 'communiti':30B 'cpdb':58B 'csv':42B 'databas':54B 'edit':31B 'editor':59B 'field':39B 'host':24B 'html':34B 'id':38B 'import':43B 'insid':68B 'limesurvey':19B,29B,73B 'list':55B,62B 'log':71B 'logged-in':70B 'make':77B 'open':60B 'origin':80B 'packag':20B 'particip':37B,53B 'permiss':84B 'php':21B 'render':47B 'request':81B 'run':67B 'same-origin':78B 'script':66B 'self':23B 'self-host':22B 'session':74B 'store':26B,33B 'stored-xss':25B 'unescap':49B 'valid':45B 'without':44B 'xss':27B,28B","search_c":"'7.7.0':88C 'access':170C 'attack':156C 'attacker-control':155C 'attribut':144C 'authent':105C,165C 'blocklist':102C 'buttongroupwidget':140C 'caus':154C 'central':99C 'communiti':86C 'contain':89C,119C 'control':103C,157C 'cpdb':132C 'cross':93C 'cross-sit':92C 'csv':116C 'data':174C 'databas':101C 'deriv':139C 'edit':87C 'editor':133C 'effect':185C 'encod':153C 'execut':160C 'exploit':168C 'expos':173C 'flow':123C 'global':109C 'html':120C,152C 'id':118C,141C,147C 'import':111C,114C,122C 'insert':149C 'issu':176C 'limesurvey':85C,138C,166C 'list':137C 'markup':158C 'model':128C 'name':143C 'open':134C 'origin':167C,179C 'particip':100C,117C,136C,146C 'participantpanel':110C 'permiss':112C,186C 'persist':124C 'request':180C 'same-origin':177C 'script':95C 'session':172C 'session-expos':171C 'site':94C 'store':91C 'user':106C 'valid':129C 'valu':126C 'victim':163C,183C 'vulner':96C 'without':127C,151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"help@fluidattacks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115640","severity":null,"published_at":"2026-11-10T05:17:47+00:00","modified_at":"2026-11-10T05:17:47+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115640:2409","url":null,"severity":null,"published_at":"2026-11-10T05:23:47+00:00","modified_at":"2026-11-10T05:23:47+00:00","first_seen_at":"2026-11-10T05:23:47+00:00","fetched_at":"2026-11-10T05:23:47+00:00","note":"Commit 4cd2818 (maintainer, 2026-10-29, issue #20810) fixes it; compare view shows tag 7.9.0+261029 is 2 commits ahead (release + translation), so it contains the fix. Release page has no notes. Commit states affected 3.0.0 to 7.7.0; 7.8.x status not stated, so fixed version taken as 7.9.0+261029 and not claimed for 7.8.x. Exploited/PoC: none seen; no social search done."}],"documents":[{"id":113199,"url":"https://github.com/LimeSurvey/LimeSurvey/commit/4cd281828422abf94468052016eba8897d5ec9aa","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":113200,"url":"https://github.com/LimeSurvey/LimeSurvey/releases/tag/7.9.0+261029","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}