CVE-2026-63361 LimeSurvey CVE debrief

Who should care

Administrators and users of LimeSurvey Community Edition 7.0.5, as well as security teams responsible for monitoring and patching vulnerabilities, should be aware of this vulnerability and take immediate action to prevent potential attacks. This includes reviewing official advisories, implementing compensating controls, and prioritizing patching of affected systems.

Technical summary

The vulnerability exists in the HTML editor popup endpoint of LimeSurvey Community Edition 7.0.5, where text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding, allowing for authenticated reflected cross-site scripting attacks. This requires immediate attention to prevent potential attacks. The vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized actions or data breaches. Defenders should verify the existence of affected systems, review official advisories, and implement compensating controls.

Defensive priority

Authenticated reflected cross-site scripting vulnerability in LimeSurvey Community Edition 7.0.5 requires immediate attention to prevent potential attacks.

Recommended defensive actions

• Apply the vendor's official patch or remediation
• Implement compensating controls such as Web Application Firewalls (WAFs)
• Monitor for suspicious activity and exception tracking
• Inventory checks for affected systems and prioritize patching
• Retest and verify vulnerability fixes

Evidence notes

The vulnerability exists in the HTML editor popup endpoint of LimeSurvey Community Edition 7.0.5, where text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding. This allows for authenticated reflected cross-site scripting attacks. Defenders should verify the existence of affected systems, review official advisories, and implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.