---
id: "CVE-2026-115640"
page: "https://infrastack.ai/live/CVE-2026-115640"
kind: "vulnerability"
aliases: ["CVE-2026-115640"]
title: "LimeSurvey: stored XSS via CSV participant import runs in admin sessions"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "limesurvey", "fixed": ["7.9.0+261029"], "affected": ">= 3.0.0, <= 7.7.0", "ecosystem": "packagist"}]
ecosystems: []
tags: ["limesurvey", "package", "php", "self-hosted", "stored-xss", "xss"]
not_affected_if: ["no-cpdb", "no-cpdb-usage", "no-untrusted-import-users"]
published_at: "2026-11-10T05:17:47+00:00"
first_seen_at: "2026-11-10T05:19:58+00:00"
updated_at: "2026-11-10T05:23:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115640", "first_seen_at": "2026-11-10T05:19:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T05:23:47+00:00"}]
exploit_sources: []
---

# LimeSurvey: stored XSS via CSV participant import runs in admin sessions

Link for people: https://infrastack.ai/live/CVE-2026-115640 (this .md is for agents)

LimeSurvey Community Edition 7.7.0 stores HTML from a participant_id field in a CSV import without validation, then renders it unescaped in the Central Participants Database list. When a CPDB editor opens that list, the attacker's script runs inside their logged-in LimeSurvey session and can make same-origin requests with their permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- packagist:limesurvey affected >= 3.0.0, <= 7.7.0 fixed 7.9.0+261029

## How to check

Check your version in the admin footer or application/config/version.php. Versions 3.0.0 to 7.7.0 are affected per the maintainer; if you are on 7.8.x or older than 7.9.0+261029, upgrade. Also review Central Participants Database for participant IDs containing HTML such as <script or onerror=, and see who holds the CPDB import permission.

## Fix

Upgrade to LimeSurvey 7.9.0+261029 (contains commit 4cd2818).

## Timeline

- 2026-11-10T05:19:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115640
- 2026-11-10T05:23:47+00:00 analyst — Commit 4cd2818 (maintainer, 2026-10-29, issue #20810) fixes it; compare view shows tag 7.9.0+261029 is 2 commits ahead (release + translation), so it contains the fix. Release page has no notes. Commit states affected 3.0.0 to 7.7.0; 7.8.x status not stated, so fixed version taken as 7.9.0+261029 and not claimed for 7.8.x. Exploited/PoC: none seen; no social search done.

## Documents

- [fix] Patch: github.com https://github.com/LimeSurvey/LimeSurvey/commit/4cd281828422abf94468052016eba8897d5ec9aa
- [fix] Release notes: github.com https://github.com/LimeSurvey/LimeSurvey/releases/tag/7.9.0+261029

## From the sources

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_