CVE-2025-41076: LimeSurvey Information Disclosure Flaw

CVE-2025-41076 Overview

CVE-2025-41076 is an information disclosure vulnerability in LimeSurvey version 6.13.0. An unauthenticated remote attacker can trigger a 500 error by sending a malformed session cookie to the survey system. Instead of returning a generic error page, the application reveals internal backend information. This includes the use of the Yii framework, the underlying MySQL/MariaDB database engine, the lime_sessions table name, primary keys, and fragments of the offending content. The vulnerability is classified under [CWE-209] (Generation of Error Message Containing Sensitive Information).

Critical Impact
Unauthenticated attackers can enumerate internal architecture details of a LimeSurvey deployment, aiding reconnaissance for follow-on attacks against the database and application framework.

Affected Products

LimeSurvey 6.13.0
Deployments using the Yii framework backend
Instances backed by MySQL or MariaDB databases

Discovery Timeline

2025-11-20 - CVE-2025-41076 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41076

Vulnerability Analysis

The flaw resides in LimeSurvey's session handling logic. When the application receives a session cookie that fails deserialization or validation, it raises an unhandled exception. The Yii framework then renders a verbose error page containing stack context, database engine details, and query fragments. This behavior exposes backend implementation details to any unauthenticated network client.

While the vulnerability does not directly enable code execution or data modification, the disclosed information accelerates reconnaissance. Attackers gain confirmation of the framework, database engine, and schema elements such as the lime_sessions table and its primary keys. This intelligence supports targeted follow-on exploitation, including SQL injection probing and framework-specific attacks.

Root Cause

The root cause is improper error handling in the session cookie parsing routine. Production deployments retain debug-style error output rather than returning a sanitized generic response. The application does not catch and normalize exceptions raised during session cookie processing before returning them to the HTTP client.

Attack Vector

Exploitation requires only network access to the LimeSurvey web interface. An attacker sends an HTTP request with a deliberately malformed session cookie value. The server processes the cookie, fails, and returns an HTTP 500 response containing internal details in the response body. No authentication, user interaction, or elevated privileges are required.

See the Incibe CERT Security Notice for advisory details.

Detection Methods for CVE-2025-41076

Indicators of Compromise

HTTP 500 responses from LimeSurvey endpoints containing strings such as lime_sessions, Yii, or CDbException.
Requests with malformed or non-standard PHPSESSID or LimeSurvey session cookie values.
Unusual clustering of 5xx responses from a single source IP against survey URLs.

Detection Strategies

Inspect web server access and error logs for repeated 500 responses correlated with anomalous Cookie headers.
Deploy WAF rules that flag session cookies containing non-base64 or non-serialized payloads targeting LimeSurvey routes.
Alert on HTTP response bodies from LimeSurvey that include framework stack strings or database schema identifiers.

Monitoring Recommendations

Enable centralized logging of HTTP status codes and response sizes for the LimeSurvey application.
Track outbound response payloads for regex matches against known Yii and MySQL error signatures.
Establish a baseline of session cookie formats and alert on high-entropy deviations from a single client.

How to Mitigate CVE-2025-41076

Immediate Actions Required

Upgrade LimeSurvey to a release later than 6.13.0 that addresses CVE-2025-41076.
Disable verbose error output in production by setting the Yii application to non-debug mode.
Restrict administrative and reconnaissance-prone endpoints behind a WAF or reverse proxy.

Patch Information

Refer to the Incibe CERT Security Notice and the LimeSurvey vendor release notes for the fixed version. Apply the vendor patch to remediate the improper error handling in session cookie processing.

Workarounds

Configure the web server or reverse proxy to intercept HTTP 500 responses from LimeSurvey and rewrite them to a generic error page.
Set the Yii YII_DEBUG constant to false and ensure errorHandler returns sanitized output in config/config.php.
Deploy WAF signatures that block requests with obviously malformed session cookies before they reach the application.

bash

# Configuration example: disable verbose errors in LimeSurvey (Yii) production config
# application/config/config.php
# 'errorHandler' => array('errorAction' => 'site/error'),
# defined('YII_DEBUG') or define('YII_DEBUG', false);