CVE-2026-102626: LimeSurvey XSS Vulnerability

CVE-2026-102626 Overview

CVE-2026-102626 is a stored cross-site scripting (XSS) vulnerability in LimeSurvey Community Edition 7.4.0. An authenticated user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding. The flaw is categorized as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers with survey-authoring permissions can execute arbitrary JavaScript in the browsers of users who render the malicious question, enabling session hijacking and actions in the victim's authenticated context.

Affected Products

LimeSurvey Community Edition 7.4.0
Date/Time question type (RenderDate.php)
DateTimePicker widget (DateTimePickerWidget/DateTimePicker.php)

Discovery Timeline

2026-10-02 - CVE-2026-102626 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-102626

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Date/Time question renderer. LimeSurvey accepts a date_min attribute from a user who holds the Surveys: create permission and stores it verbatim. During rendering, the server embeds the stored value inside a single-quoted JavaScript string literal that configures the DateTimePicker widget without any JavaScript-context escaping.

An attacker can supply a value that terminates the quoted literal and appends arbitrary JavaScript. When a second user, including an administrator, loads the affected question, the attacker's script executes in that user's browser session. Because exploitation requires only victim rendering of the question, impact extends to any account that previews or responds to the survey.

Root Cause

The root cause lies in two code paths. In application/core/QuestionTypes/Date/RenderDate.php, when date_min does not match a strict date pattern, the code falls back to wrapping the raw attribute in curly braces for expression evaluation without HTML or JavaScript escaping. In application/extensions/DateTimePickerWidget/DateTimePicker.php, the getRestrictionsOptionsString() method concatenates $minDate directly into a single-quoted JavaScript string. Neither path performs context-aware output encoding for JavaScript.

Attack Vector

Exploitation requires an authenticated user with the Surveys: create global permission. The attacker crafts a Date/Time question whose date_min attribute contains a single quote followed by JavaScript. The payload is persisted in the survey definition. Any user who subsequently renders the question executes the attacker's script. User interaction (UI:A) is required because the victim must view the rendered question.

php

// Vulnerable code in application/core/QuestionTypes/Date/RenderDate.php
} elseif (preg_match("/^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])/", $date_min)) {
    // it's a YYYY-MM-DD date
    $this->minDate = $date_min;
} elseif ($date_time_em !== false) {
    $this->minDate = (string) date("Y-m-d", $date_time_em);
} else {
    // Unescaped attribute wrapped for expression evaluation
    $this->minDate = '{' . $this->getQuestionAttribute('date_min') . '}';
}

// Vulnerable code in application/extensions/DateTimePickerWidget/DateTimePicker.php
$minDate = $this->getValue('data-minDate', $this->htmlOptions, 'undefined');
$minDate = $minDate != 'undefined' ? "'$minDate'" : $minDate;

Source: LimeSurvey Commit 32e54f1

Detection Methods for CVE-2026-102626

Indicators of Compromise

Date/Time question definitions whose date_min or date_max attributes contain single quotes, angle brackets, or JavaScript keywords such as alert, fetch, or document.cookie.
Outbound requests from administrator browsers to unexpected domains shortly after loading survey preview or response pages.
Audit log entries showing new or edited surveys created by low-privilege authors immediately before admin-session anomalies.

Detection Strategies

Query the LimeSurvey database for question_attributes rows where attribute IN (date_min, date_max) and value matches characters disallowed by the fixed QuestionAttribute::DATE_LIMIT_PATTERN.
Inspect rendered survey pages for inline minDate: or maxDate: JavaScript options containing unexpected single quotes or script fragments.
Correlate web server access logs with session identifiers to identify administrator accounts viewing surveys authored by non-admin users.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations originating from LimeSurvey pages.
Forward LimeSurvey application and web server logs to a centralized analytics platform for correlation of survey edits with downstream authentication activity.
Alert on creation or modification of Date/Time questions by accounts that do not normally author surveys.

How to Mitigate CVE-2026-102626

Immediate Actions Required

Upgrade LimeSurvey Community Edition past 7.4.0 to a build that includes commit 32e54f1.
Audit existing Date/Time questions for malicious date_min and date_max values and remove any that do not match the expected date pattern.
Restrict the Surveys: create permission to trusted accounts and require strong authentication for those users.

Patch Information

The upstream fix is published in LimeSurvey Commit 32e54f1. The patch validates date_min against QuestionAttribute::DATE_LIMIT_PATTERN, wraps expression results in htmlspecialchars(), and escapes the value in DateTimePicker.php using CJavaScript::quote() before embedding it in the inline JavaScript literal. See the Fluid Attacks Advisory and the LimeSurvey GitHub Repository for additional context.

Workarounds

Revoke the Surveys: create global permission from any account that does not require it until the patch is applied.
Deploy a restrictive Content Security Policy that disallows inline scripts, reducing the impact of injected JavaScript.
Place a web application firewall rule in front of LimeSurvey that blocks requests containing single quotes or script fragments in date_min and date_max parameters.

bash

# Example: apply patch and restart web server
cd /var/www/limesurvey
git fetch origin
git cherry-pick 32e54f14f0b4ddc2d8144daaabf7e23c3bbfb8e8
systemctl restart apache2