CVE-2025-63238 LimeSurvey CVE debrief

Who should care

Defenders responsible for LimeSurvey instances, particularly those with publicly accessible survey creation or editing features, should assess exposure and apply patches. This includes verifying LimeSurvey instance versions, reviewing and validating user input for survey gid parameters, and implementing additional security measures. Defenders should also review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2025-63238 is a Reflected Cross-Site Scripting (XSS) vulnerability in LimeSurvey that allows attackers to craft malicious URLs and compromise logged-in users. Defenders should prioritize verifying exposure and applying patches for LimeSurvey instances, particularly those with publicly accessible survey creation or editing features.

• Defenders must verify LimeSurvey instance versions and apply patches to prevent exploitation
• Publicly accessible survey creation or editing features increase the attack surface
• Successful exploitation could lead to user compromise

Technical summary

The vulnerability is due to the lack of validation of the gid parameter in the getInstance() function in application/models/QuestionCreate.php, allowing an attacker to craft a malicious URL and compromise the logged-in user. The vulnerability affects LimeSurvey versions prior to 6.15.11+250909 and has a CVSS score of 6.1 with a severity of MEDIUM. Defenders should prioritize verifying exposure and applying patches for LimeSurvey instances, particularly those with publicly accessible survey creation or editing features.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for LimeSurvey instances, particularly those with publicly accessible survey creation or editing features.

Recommended defensive actions

• Verify LimeSurvey instance versions and apply patches to vulnerable versions prior to 6.15.11+250909
• Review and validate user input for survey gid parameters
• Implement additional security measures for publicly accessible survey creation or editing features
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, additional information on exploitation or affected deployments is limited. The vulnerability affects LimeSurvey versions prior to 6.15.11+250909. There are no known instances of exploitation, but defenders should verify exposure and apply patches. The CVE Program and NVD provide official records and assessments of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.