Is there a patch available for CVE-2026-18403?

Yes, a patch is available for CVE-2026-18403. Update the affected software to the latest version immediately.

LimeSurvey CVE-2026-18403

Q: What is the CVSS score of CVE-2026-18403?

CVE-2026-18403 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58786 MEDIUM

SQL Injection (CWE-89)

2026-08-14 Fluid Attacks

GHSA-fxx2-xm5f-gmf5

SQLi Limesurvey

6.0

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Authenticated access (PR:L) and active CPDB feature use required (AC:H); SQL injection in UPDATE context yields high confidentiality but limited integrity impact with no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 19:21 vuln.today

Analysis Generated

Aug 14, 2026 - 19:21 vuln.today

DescriptionCVE.org

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

AnalysisAI

SQL injection in LimeSurvey Community Edition 7.0.5 exposes the Central Participant Database (CPDB) token-copy workflow to authenticated database exfiltration. An attacker with survey-level access can inject malicious SQL through unsanitized participantId, surveyId, tokenFieldname, and participantAttributeId parameters in Participant.php, achieving high-confidence read access to the underlying database with limited write impact. No public exploit identified at time of analysis; a vendor fix is available as a GitHub commit but a formally versioned patched release is not independently confirmed.

Technical ContextAI

The affected component is application/models/Participant.php in LimeSurvey's Yii-based PHP application. The updateTokenAttributeValue() and updateAttributeValueToken() methods constructed SQL UPDATE statements by directly interpolating user-controlled values - $participantId, $surveyId, $tokenFieldname, and $participantAttributeId - into query strings without prepared statements or input validation. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) applies: the application failed to distinguish data from SQL structure, allowing injection through the query string. The copyToCentral() method additionally accepted attacker-controlled attribute mapping keys that were passed into SQL contexts without field-name validation. The fix, visible in commit 7735ce31cea1cad087b0c8556cb65a1c09e29cbd, introduces parameterized queries using :participant_id and :attribute_id placeholders, intval() casting for $surveyId to prevent table-name injection, regex validation for $participantAttributeId (must match /^[1-9][0-9]*$/), and a new isValidTokenAttributeFieldname() method that cross-checks $tokenFieldname against the pattern attribute_[0-9]+ and against the survey's actual token attribute schema before allowing it near SQL.

RemediationAI

Apply the vendor-provided fix by updating to a LimeSurvey Community Edition version that incorporates commit 7735ce31cea1cad087b0c8556cb65a1c09e29cbd (https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd); note that a specific patched release version number is not confirmed from available data - verify remediation by inspecting application/models/Participant.php for the presence of parameterized queries and the isValidTokenAttributeFieldname() method. If immediate patching is not feasible, restrict access to the Central Participant Database (CPDB) and the token-copy workflow to only highly trusted administrator-level accounts, reducing the pool of potential attackers; this reduces risk but does not eliminate it since administrators retain access. As an additional compensating control, configure the application's database user account with the minimum required privileges - specifically, remove or restrict UPDATE permissions on participant_attribute and tokens_* tables where survey read-only access is sufficient - to limit the blast radius of any successful injection. Enable and monitor database query logs for anomalous UPDATE patterns involving participant-related tables. The Fluid Attacks advisory is at https://fluidattacks.com/es/advisories/rihanna.