CVE-2026-63361
Received Received - Intake

Authenticated Reflected XSS in LimeSurvey Community Edition HTML Editor

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Fluid Attacks

Description
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-63361
EUVD
EUVD-2026-58731

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
limesurvey limesurvey 7.0.5
limesurvey limesurvey 7.0.10
limesurvey community_edition 7.0.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LimeSurvey Community Edition 7.0.5 has a reflected cross-site scripting (XSS) vulnerability in the HTML editor popup endpoint. User input for the 'text' and 'name' parameters is not properly sanitized before being rendered in the HTML output. This allows attackers to inject malicious scripts that execute in the context of an authenticated user's session.

Detection Guidance

To detect this vulnerability, inspect LimeSurvey instances for version 7.0.5. Check the file application/views/admin/htmleditor/pop_editor_view.php for improper sanitization of 'text' and 'name' parameters. Look for missing CHtml::encode() or CJavaScript::encode() calls in HTML or JavaScript contexts.

Impact Analysis

An attacker could trick an authenticated LimeSurvey user into opening a specially crafted URL, leading to the execution of arbitrary JavaScript code. This could result in session hijacking, data theft, or unauthorized actions performed on behalf of the user. The vulnerability requires user interaction but can be exploited via phishing or social engineering.

Compliance Impact

This vulnerability could compromise data confidentiality and integrity, potentially violating GDPR's data protection requirements or HIPAA's security rules. Unauthorized script execution may lead to unauthorized access to sensitive data, triggering compliance violations and legal consequences.

Mitigation Strategies

Upgrade LimeSurvey to version 7.0.10 or later. Ensure all user-supplied input in the HTML editor popup endpoint is properly encoded using CHtml::encode() for HTML and CJavaScript::encode() for JavaScript contexts. Review and apply the patch from the commit a8993bfd05c4a11255b8400ed9c41a2c22e93aa4.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart