LIMESURVEY COMMUNITY EDITION · CVE-2026-116645 · Package
NO FIX YET
LimeSurvey Community Edition 7.8.0 passes an attribute name from an imported survey archive into a query builder that treats parenthesized names as SQL expressions. A logged-in user who can create surveys can run attacker-chosen SQL with the application's database privileges.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only LimeSurvey Community Edition 7.8.0 is named in the sources. Exposure needs a user with global surveys.create permission who can import a crafted .lsa archive and then export SPSS responses from the imported non-anonymous survey. Instances where only trusted administrators hold survey creation rights are at lower risk, but the sources do not say which other configurations are safe.
Not affected if anonymous-surveys-only, no-survey-create-users
Who cares limesurvey, php, self-hosted
7.8.0.Unknown from the sources.
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.