CVE-2025-41076: Multiple vulnerabilities in Limesurvey
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'limesessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41076?
CVE-2025-41076 has been rated as a medium severity vulnerability due to its potential to expose sensitive backend information.
How do I fix CVE-2025-41076?
To fix CVE-2025-41076, upgrade to the latest version of LimeSurvey where this vulnerability has been patched.
What type of attack does CVE-2025-41076 enable?
CVE-2025-41076 allows attackers to send malformed session cookies that can trigger a 500 error, revealing internal system details.
Who is affected by CVE-2025-41076?
Any users of LimeSurvey version 6.13.0 are affected by CVE-2025-41076.
What components are involved in CVE-2025-41076?
CVE-2025-41076 involves the Yii framework and MySQL/MariaDB as part of the underlying technology stack.