CVE-2026-115640: LimeSurvey Community Edition 7.7.0 - Stored XSS in Central Participants blocklist control
LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participantid and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LimeSurvey Community Editionto a version that resolves this vulnerability.Fixed in 7.9.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability and who is at risk?
An authenticated LimeSurvey user granted the global participantpanel:import permission can supply a crafted CSV participant_id. Users who open the Central Participants Database participant list as an editor are exposed to script execution in their authenticated LimeSurvey session.
Is interaction by another user required for exploitation?
Yes. The attacker must import the malicious participant_id, and a CPDB editor must subsequently open the participant list containing that stored value. The payload then executes in the editor's authenticated LimeSurvey origin.
What can the injected script do?
The script can access data exposed to the victim's session and make same-origin requests using the victim's effective permissions.
How can I determine whether my instance may be affected?
The affected import path accepts CSV participant_id values and persists them without model validation; the participant list later derives unencoded ButtonGroupWidget id and name attributes from that value. Review imported Central Participants Database records for participant_id values containing HTML or markup characters.
What mitigation is available if patching cannot be applied immediately?
Restrict the global participantpanel:import permission to trusted users and review or remove suspicious participant_id values from Central Participants Database imports. Limit access to the participant list for editors until imported data has been checked.