CVE-2026-63107
Received Received - Intake

Server-Side Request Forgery in LimeSurvey

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63107
EUVD
EUVD-2026-46061

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lime_survey lime_survey to 6.17.10|start_including=7.0.4 (inc)
limesurvey limesurvey to 6.17.10 (inc)
limesurvey limesurvey to 7.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63107 is a Server-Side Request Forgery (SSRF) vulnerability in LimeSurvey's REST API survey template endpoint. An authenticated user can manipulate the HTTP Host header to force the server to make arbitrary HTTP requests to internal or external hosts. This occurs in the getTemplateData() function where the Host header is used unsafely to construct a URL for a curl request without proper validation.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual outbound HTTP requests from your LimeSurvey server, especially to internal or cloud metadata endpoints. Check logs for requests to AWS IMDSv1 (169.254.169.254) or other internal services. Use curl commands to test if the survey template endpoint accepts manipulated Host headers: curl -H 'Host: malicious.example.com' http://<limesurvey-server>/index.php/rest/v1/survey-template/1. If the server responds with data from the specified host, the vulnerability may exist.

Inspect application logs for errors related to curl_exec() calls in the getTemplateData() function. Enable verbose logging in your reverse proxy or web server to capture Host header modifications.

Impact Analysis

An attacker with survey read access could exploit this to access internal network services, cloud metadata endpoints, or steal sensitive credentials like IAM tokens from services such as AWS IMDSv1. The server's full HTTP response is returned, enabling network discovery and data exfiltration.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems and sensitive data, potentially violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Attackers may exfiltrate credentials or internal data, which could result in non-compliance with these regulations.

Mitigation Strategies

Upgrade LimeSurvey to the latest version beyond 6.17.10 and 7.0.4, as patches address the Host header misuse. If upgrading is not immediately possible, configure your reverse proxy to enforce a fixed Host header and block requests with modified headers.

Restrict network access to cloud metadata endpoints (e.g., AWS IMDSv1) from the LimeSurvey server. Implement network segmentation to limit outbound requests to trusted hosts only. Disable the survey template endpoint if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart