CVE-2025-41075: Multiple vulnerabilities in Limesurvey

Published Nov 20, 2025

Updated

Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.

Affected Software

2 affected components

Limesurvey LimeSurvey

Limesurvey LimeSurvey=6.13.0

Remediation

Information

The vulnerabilities have been fixed by the Limesurvey team in the version 6.15.0.

Event History

Nov 20, 2025

CVE Published

via MITRE·12:49 PM

Data Sourced

via MITRE·12:49 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Apr 1, 57861

Event

via NVD·03:56 AM

Frequently Asked Questions

What is the severity of CVE-2025-41075?

CVE-2025-41075 has a high severity level due to its potential to cause Denial of Service attacks.

How does CVE-2025-41075 affect LimeSurvey?

CVE-2025-41075 causes infinite HTTP redirects in LimeSurvey, leading to resource exhaustion.

What are the potential impacts of CVE-2025-41075?

The impact of CVE-2025-41075 can result in a Denial of Service, affecting both server and client resources.

How can I fix CVE-2025-41075?

To fix CVE-2025-41075, update LimeSurvey to the latest version that addresses this vulnerability.

Is CVE-2025-41075 easy to exploit?

CVE-2025-41075 is relatively easy to exploit, as it requires simply accessing the affected endpoint.