CVE-2026-63107: LimeSurvey SSRF via REST API Survey Template Host Header
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63107?
CVE-2026-63107 has a severity rating of high with a score of 7.7.
What vulnerability does CVE-2026-63107 describe?
CVE-2026-63107 describes a server-side request forgery vulnerability in LimeSurvey's REST API survey template endpoint.
How can I fix CVE-2026-63107?
To fix CVE-2026-63107, update LimeSurvey to version 6.17.11 or 7.0.5 or later, where the vulnerability has been addressed.
Who can exploit CVE-2026-63107?
Authenticated users can exploit CVE-2026-63107 by supplying a manipulated Host header in a request.
What impact does CVE-2026-63107 have on LimeSurvey?
CVE-2026-63107 allows attackers to issue arbitrary HTTP requests from the server, potentially leading to unauthorized access to internal resources.