{"id":"CVE-2026-116645","kind":"vulnerability","aliases":["CVE-2026-116645"],"related":[],"title":"LimeSurvey: crafted survey archive import lets authenticated users run SQL","description":"LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.","summary":"LimeSurvey Community Edition 7.8.0 passes an attribute name from an imported survey archive into a query builder that treats parenthesized names as SQL expressions. A logged-in user who can create surveys can run attacker-chosen SQL with the application's database privileges.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"LimeSurvey Community Edition","fixed":[],"affected":"7.8.0","ecosystem":"php"}],"ecosystems":[],"tags":["limesurvey","package","php","self-hosted"],"not_affected_if":["anonymous-surveys-only","no-survey-create-users"],"how_to_check":"- Check the installed LimeSurvey version in the admin panel or in the application's version file; the affected version is `7.8.0`.\n- Look for survey-archive (.lsa) import use by users with the global surveys.create permission.","fix":null,"status":"open","published_at":"2026-11-11T03:16:48+00:00","first_seen_at":"2026-11-11T03:24:59+00:00","triaged_at":"2026-11-11T03:26:22+00:00","updated_at":"2026-11-11T03:27:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T03:26:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"LimeSurvey: crafted survey archive import lets authenticated users run SQL","impact":"high","summary":"LimeSurvey Community Edition 7.8.0 passes an attribute name from an imported survey archive into a query builder that treats parenthesized names as SQL expressions. A logged-in user who can create surveys can run attacker-chosen SQL with the application's database privileges.","audience":"businesses","category":"package","nicknames":[],"who_cares":["limesurvey","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs SQL as the application's database user, reading or changing data","analyst_note":"Fixed version and vendor advisory are not in the sources; check the LimeSurvey security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116645) for a patched release.","how_to_check":"- Check the installed LimeSurvey version in the admin panel or in the application's version file; the affected version is `7.8.0`.\n- Look for survey-archive (.lsa) import use by users with the global surveys.create permission.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-survey-create-users","anonymous-surveys-only"],"who_is_affected":"Only LimeSurvey Community Edition 7.8.0 is named in the sources. Exposure needs a user with global surveys.create permission who can import a crafted .lsa archive and then export SPSS responses from the imported non-anonymous survey. Instances where only trusted administrators hold survey creation rights are at lower risk, but the sources do not say which other configurations are safe.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4654,"output_tokens":626,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed version and vendor advisory are not in the sources; check the LimeSurvey security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116645) for a patched release.","search":"'-116645':13A,16A '-2026':12A,15A '7.8.0':29B,74C 'anonym':126C 'applic':67B,159C 'archiv':4A,38B,84C,105C 'attack':62B,112C,152C 'attacker-chosen':61B 'attacker-control':151C 'attacker-nam':111C 'attribut':32B,114C 'authent':7A,94C 'builder':42B,137C 'caus':150C 'chosen':63B 'column':115C 'communiti':27B,72C 'community':18A 'contain':75C,139C 'control':153C 'craft':2A,103C 'creat':57B,109C 'cve':11A,14A 'databas':69B,161C 'edit':28B,73C 'edition':19A 'execut':156C 'export':91C,119C 'express':49B,145C 'global':97C 'host':25B 'identifi':149C 'import':5A,36B,86C,101C,123C 'inject':78C 'instead':146C 'let':6A 'limesurvey':1A,17A,20B,26B,71C,128C 'log':52B 'logged-in':51B 'lsa':104C 'name':33B,46B,113C,132C,138C 'non':125C 'non-anonym':124C 'packag':21B 'parenthes':45B,140C 'particip':85C,107C 'pass':30B,129C 'permiss':99C 'persist':131C 'php':22B 'privileg':70B,162C 'queri':41B 'quot':148C 'respons':90C,120C 'run':9A,60B 'select':136C 'self':24B 'self-host':23B 'spss':89C 'spss-respons':88C 'sql':10A,48B,64B,77C,144C,154C 'survey':3A,37B,58B,83C,127C 'survey-arch':82C 'surveys.create':98C 'treat':44B,142C 'user':8A,54B,95C,118C 'vulner':79C 'whose':106C 'workflow':92C 'xml':108C 'yii':134C","nicknames":[],"mitigations":[],"who_affected":"Only LimeSurvey Community Edition 7.8.0 is named in the sources. Exposure needs a user with global surveys.create permission who can import a crafted .lsa archive and then export SPSS responses from the imported non-anonymous survey. Instances where only trusted administrators hold survey creation rights are at lower risk, but the sources do not say which other configurations are safe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["communityedition","limesurveycommunityedition"],"ptokens":["community","edition","limesurvey"],"labels":["high","limesurvey","package","php","selfhosted"],"campaign_type":null,"search_a":"'-116645':13A,16A '-2026':12A,15A 'archiv':4A 'authent':7A 'community':18A 'craft':2A 'cve':11A,14A 'edition':19A 'import':5A 'let':6A 'limesurvey':1A,17A 'run':9A 'sql':10A 'survey':3A 'user':8A","search_b":"'7.8.0':29B 'applic':67B 'archiv':38B 'attack':62B 'attacker-chosen':61B 'attribut':32B 'builder':42B 'chosen':63B 'communiti':27B 'creat':57B 'databas':69B 'edit':28B 'express':49B 'host':25B 'import':36B 'limesurvey':20B,26B 'log':52B 'logged-in':51B 'name':33B,46B 'packag':21B 'parenthes':45B 'pass':30B 'php':22B 'privileg':70B 'queri':41B 'run':60B 'self':24B 'self-host':23B 'sql':48B,64B 'survey':37B,58B 'treat':44B 'user':54B","search_c":"'7.8.0':74C 'anonym':126C 'applic':159C 'archiv':84C,105C 'attack':112C,152C 'attacker-control':151C 'attacker-nam':111C 'attribut':114C 'authent':94C 'builder':137C 'caus':150C 'column':115C 'communiti':72C 'contain':75C,139C 'control':153C 'craft':103C 'creat':109C 'databas':161C 'edit':73C 'execut':156C 'export':91C,119C 'express':145C 'global':97C 'identifi':149C 'import':86C,101C,123C 'inject':78C 'instead':146C 'limesurvey':71C,128C 'lsa':104C 'name':113C,132C,138C 'non':125C 'non-anonym':124C 'parenthes':140C 'particip':85C,107C 'pass':129C 'permiss':99C 'persist':131C 'privileg':162C 'quot':148C 'respons':90C,120C 'select':136C 'spss':89C 'spss-respons':88C 'sql':77C,144C,154C 'survey':83C,127C 'survey-arch':82C 'surveys.create':98C 'treat':142C 'user':95C,118C 'vulner':79C 'whose':106C 'workflow':92C 'xml':108C 'yii':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T03:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"help@fluidattacks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116645","severity":null,"published_at":"2026-11-11T03:16:48+00:00","modified_at":"2026-11-11T03:16:48+00:00","first_seen_at":"2026-11-11T03:24:59+00:00","fetched_at":"2026-11-11T03:24:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116645:3496","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt","severity":null,"published_at":"2026-11-11T03:27:25+00:00","modified_at":"2026-11-11T03:27:25+00:00","first_seen_at":"2026-11-11T03:27:25+00:00","fetched_at":"2026-11-11T03:27:25+00:00","note":"NVD page returned no text; no LimeSurvey advisory or release-note entry for this SQL issue found in 7.8.0-7.10.0 notes (latest 7.10.0 build 261109, 9 Nov 2026). Fix version unknown: settle by LimeSurvey GitHub security advisory or the patch commit. Nothing verified. Only 7.8.0 is named by the CVE text; neighbouring entries suggest earlier versions may be affected too, unconfirmed. Linked release notes as 'mentions' only. Advice for now: restrict surveys.create permission and .lsa import to trusted users, and update to the latest release (7.10.0), which may or may not include a fix.","cites":["https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt"]}],"documents":[{"id":122200,"url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt","title":"LimeSurvey release notes (7.10.0 build 261109 and earlier)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}