---
id: "CVE-2026-116645"
page: "https://infrastack.ai/live/CVE-2026-116645"
kind: "vulnerability"
aliases: ["CVE-2026-116645"]
title: "LimeSurvey: crafted survey archive import lets authenticated users run SQL"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "LimeSurvey Community Edition", "fixed": [], "affected": "7.8.0", "ecosystem": "php"}]
ecosystems: []
tags: ["limesurvey", "package", "php", "self-hosted"]
not_affected_if: ["anonymous-surveys-only", "no-survey-create-users"]
published_at: "2026-11-11T03:16:48+00:00"
first_seen_at: "2026-11-11T03:24:59+00:00"
updated_at: "2026-11-11T03:27:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116645", "first_seen_at": "2026-11-11T03:24:59+00:00"}, {"source": "analyst", "url": "https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt", "first_seen_at": "2026-11-11T03:27:25+00:00", "cites": ["https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt"]}]
exploit_sources: []
---

# LimeSurvey: crafted survey archive import lets authenticated users run SQL

Link for people: https://infrastack.ai/live/CVE-2026-116645 (this .md is for agents)

LimeSurvey Community Edition 7.8.0 passes an attribute name from an imported survey archive into a query builder that treats parenthesized names as SQL expressions. A logged-in user who can create surveys can run attacker-chosen SQL with the application's database privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- php:LimeSurvey Community Edition affected 7.8.0 fixed no fixed version listed

## How to check

- Check the installed LimeSurvey version in the admin panel or in the application's version file; the affected version is `7.8.0`.
- Look for survey-archive (.lsa) import use by users with the global surveys.create permission.

## Timeline

- 2026-11-11T03:24:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116645
- 2026-11-11T03:27:25+00:00 analyst https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt — NVD page returned no text; no LimeSurvey advisory or release-note entry for this SQL issue found in 7.8.0-7.10.0 notes (latest 7.10.0 build 261109, 9 Nov 2026). Fix version unknown: settle by LimeSurvey GitHub security advisory or the patch commit. Nothing verified. Only 7.8.0 is named by the CVE text; neighbouring entries suggest earlier versions may be affected too, unconfirmed. Linked release notes as 'mentions' only. Advice for now: restrict surveys.create permission and .lsa import to trusted users, and update to the latest release (7.10.0), which may or may not include a fix.

## Documents

- [mentions] LimeSurvey release notes (7.10.0 build 261109 and earlier) https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release%5Fnotes.txt

## From the sources

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_