CVE-2026-116645 LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes
Description
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NExploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- Interaction
- None
- Confidentiality
- High
- Integrity
- None
- Availability
- None
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LimeSurvey Community Edition | 7.8.0 | No fix stated |