Which versions of LimeSurvey are affected by CVE-2026-63361?

LimeSurvey Community Edition 7.0.5 contains a vulnerability (CVE-2026-63361, CVSS 8.5) that allows attackers to compromise administrator accounts through a malicious link delivered outside normal…. A patch is available.

How to fix or mitigate CVE-2026-63361?

Within 24 hours, identify all LimeSurvey Community Edition 7.0.5 instances and confirm patch availability from the vendor. Within 7 days, apply the vendor patch to all instances and validate that survey operations continue normally. Within 30 days, achieve 100% patch deployment across all LimeSurvey systems, conduct administrator security awareness training on verifying external links, and implement Web Application Firewall rules to block XSS attack patterns targeting the LimeSurvey HTML editor endpoint.

LimeSurvey CVE-2026-63361

Q: What is the CVSS score of CVE-2026-63361?

CVE-2026-63361 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58731 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-14 Fluid Attacks

GHSA-r82m-pqrh-phxp

XSS Limesurvey

8.5

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Attacker needs no credentials to craft the link (PR:N) but victim must actively click it (UI:R); successful exploitation changes scope to the admin's browser session with full session compromise potential (S:C, C:H, I:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 17:51 vuln.today

Analysis Generated

Aug 14, 2026 - 17:51 vuln.today

CVE Published

Aug 14, 2026 - 17:04 cve.org

HIGH 8.5

DescriptionCVE.org

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.

AnalysisAI

Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The text and name query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript window.status assignment, and multiple document.getElementById() calls - confirmed by the patch commit diff. No public exploit has been identified at time of analysis, but an upstream fix is available as a merged GitHub commit and a vendor patch is listed as available.

Technical ContextAI

The vulnerability resides in application/views/admin/htmleditor/pop_editor_view.php, the popup view for LimeSurvey's CKEditor-based HTML editing interface. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies: the root cause is reliance on a blacklist sanitizer rather than context-appropriate output encoding. The commit diff (a8993bfd05c4a11255b8400ed9c41a2c22e93aa4) reveals four distinct injection sinks: the <title> HTML context (fixed with CHtml::encode()), a window.status JavaScript string assignment, and three window.opener.document.getElementById() JavaScript identifier contexts (all fixed with CJavaScript::encode()). The multi-context nature of the flaw - covering both HTML and JavaScript execution contexts - compounds the risk and indicates the blacklist control was fundamentally insufficient. The affected CPE is cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*, with the wildcard version range suggesting earlier releases sharing the same vulnerable template may also be affected.

RemediationAI

Apply the upstream fix available at commit a8993bfd05c4a11255b8400ed9c41a2c22e93aa4 in the LimeSurvey GitHub repository (https://github.com/LimeSurvey/LimeSurvey/commit/a8993bfd05c4a11255b8400ed9c41a2c22e93aa4), which replaces blacklist-based sanitization with context-appropriate encoding - CHtml::encode() for HTML contexts and CJavaScript::encode() for JavaScript string and identifier contexts - across all affected sinks in pop_editor_view.php. Upstream fix available via commit; a formally tagged patched release version has not been independently confirmed from available data, so verify the commit is included in any LimeSurvey release being considered before upgrading. As a compensating control where immediate patching is not feasible, restrict access to the HTML editor popup endpoint (/admin/htmleditor/popupeditor or equivalent) to trusted internal IP ranges via web server ACL or WAF rule - note this disables the HTML editor popup for all users, including administrators. Adding a restrictive Content-Security-Policy header that disallows inline scripts provides partial impact reduction but does not eliminate the vulnerability. Refer to the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/mercedes for researcher-provided detail.