Is there a public PoC exploit available for CVE-2026-63107?

Yes, a public proof-of-concept exploit is available for CVE-2026-63107. Prioritise patching immediately. EPSS: 0.2%.

LimeSurvey CVE-2026-63107

Q: What is the CVSS score of CVE-2026-63107?

CVE-2026-63107 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46061 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-20 VulnCheck

GHSA-34qp-wv4h-827h

SSRF Limesurvey

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-accessible REST API requires only a low-privilege account; scope change applies because SSRF reaches external systems, with high confidentiality impact from potential IAM credential extraction.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:28 vuln.today

CVE Published

Jul 20, 2026 - 18:14 cve.org

MEDIUM 6.3

DescriptionCVE.org

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.

AnalysisAI

Server-side request forgery in LimeSurvey through versions 6.17.10 and 7.0.4 exposes internal network infrastructure and cloud instance metadata to authenticated attackers via the REST API survey template endpoint. The vulnerability stems from unsanitized use of the HTTP Host header inside the getTemplateData() function, enabling the application server to be weaponized as a proxy to reach internal services and cloud metadata APIs such as AWS IMDSv1 at 169.254.169.254, potentially yielding IAM role credentials. A public proof-of-concept exploit is available via GitHub, raising the urgency of remediation despite the absence of a CISA KEV listing; no public exploit identified at time of analysis for active in-the-wild campaigns, but POC lowers the bar significantly for opportunistic exploitation.

Technical ContextAI

LimeSurvey (CPE: cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*) is an open-source PHP-based survey platform. The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the application server is coerced into issuing HTTP requests on behalf of the attacker. Specifically, the REST API endpoint responsible for fetching survey template data accepts and trusts the HTTP Host header to construct downstream requests inside getTemplateData(), without validating or sanitizing the header value. This is a classic Host header injection enabling SSRF: by supplying a crafted Host value, an authenticated caller redirects server-originated requests to arbitrary internal targets. In cloud-hosted deployments, this most critically enables access to Instance Metadata Service (IMDS) endpoints that serve ephemeral IAM credentials, making the vulnerability a lateral movement and privilege escalation primitive in AWS, GCP, and Azure environments.

RemediationAI

No vendor-released patch version was identified in available data at time of analysis - organizations should monitor the LimeSurvey release notes and the VulnCheck advisory at https://www.vulncheck.com/advisories/limesurvey-ssrf-via-rest-api-survey-template-host-header for a confirmed fix. Until a patch is available, the most effective compensating control for cloud-hosted instances is enforcing IMDSv2 (token-based) on AWS EC2, which blocks unauthenticated IMDS access from SSRF payloads that cannot follow the required PUT pre-flight request; note that this mitigates metadata credential theft but does not prevent SSRF probing of other internal services. A second control is restricting the LimeSurvey REST API to known trusted IP ranges at the network perimeter or WAF layer, reducing the population of callers who can trigger getTemplateData(). Egress filtering on the LimeSurvey application server to block outbound requests to RFC-1918 address space and link-local ranges (169.254.0.0/16) also directly limits SSRF reachability, though this may interfere with legitimate integrations. Organizations should audit low-privilege LimeSurvey account holders, as any authenticated user can trigger the exploit per the CVSS PR:L rating. The PoC at https://github.com/geo-chen/oss/blob/main/limesurvey.md can be used to validate whether deployed instances are vulnerable.