CVE-2026-15973: LimeSurvey XSS Vulnerability

CVE-2026-15973 Overview

CVE-2026-15973 is a stored cross-site scripting (XSS) vulnerability in LimeSurvey Community Edition 7.0.5. The flaw resides in the Survey Menu Entries administration page. An authenticated user holding the settings:read global permission can inject attacker-controlled data into a survey menu entry. The value persists in the surveymenu_entries.data field and is later rendered inside a single-quoted HTML title attribute without context-appropriate encoding. Any administrator or user who loads the affected page executes the injected JavaScript in their browser session. The issue is tracked under CWE-79.

Critical Impact
Stored XSS enables session hijacking, administrative action forgery, and lateral compromise of LimeSurvey installations through authenticated attacker payloads persisted in menu entries.

Affected Products

LimeSurvey Community Edition 7.0.5
LimeSurvey installations exposing the Survey Menu Entries administration interface
Deployments granting the settings:read global permission to non-administrative users

Discovery Timeline

2026-08-26 - CVE-2026-15973 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15973

Vulnerability Analysis

The vulnerability is a persistent cross-site scripting flaw in the LimeSurvey administrative interface. The Survey Menu Entries feature allows privileged users to define custom menu items rendered inside the administrative dashboard. User-supplied content sent to the surveymenu_entries.data field is stored server-side and later re-emitted into HTML markup during page rendering. The affected sink writes the value into a single-quoted title attribute. Because the application does not apply attribute-context encoding for single quotes and angle brackets, an attacker can terminate the attribute and inject arbitrary HTML or JavaScript. Payloads execute in the browser of every administrator who subsequently loads the menu page.

Root Cause

The root cause is missing output encoding at an HTML attribute sink. LimeSurvey trusts data retrieved from surveymenu_entries.data and interpolates it directly into a single-quoted attribute value. Encoding routines that neutralize <, >, ", and ' characters are not applied to this context. The flaw is a classic instance of improper neutralization of input during web page generation ([CWE-79]).

Attack Vector

Exploitation requires an authenticated account with the settings:read global permission. The attacker creates or modifies a survey menu entry and supplies a payload that closes the surrounding single-quoted title attribute and appends event-handler attributes or an inline <script> element. The malicious record persists in the database. When an administrator or another user with access to the affected view opens the Survey Menu Entries page, the browser parses the injected markup and executes the attacker's JavaScript. Post-exploitation actions include stealing session cookies, issuing authenticated requests on the victim's behalf, or pivoting to other administrative functions.

Because verified exploit code is not published, refer to the Fluid Attacks Security Advisory and the GitHub LimeSurvey Repository for source-level detail.

Detection Methods for CVE-2026-15973

Indicators of Compromise

Survey menu entries whose data field contains HTML metacharacters such as ', <, >, or on*= event handler names.
Unexpected <script>, <img>, or <svg> fragments appearing in rendered HTML of the Survey Menu Entries administration page.
Administrator sessions issuing anomalous state-changing API calls shortly after loading /admin/menuentries routes.

Detection Strategies

Query the LimeSurvey database for rows in surveymenu_entries where the data column matches regular expressions targeting HTML tags or JavaScript event handlers.
Deploy web application firewall rules that flag POST requests to survey menu administration endpoints containing script tags or attribute-breaking single quotes.
Review web server access logs for administrative POST requests submitted by non-administrator accounts holding settings:read.

Monitoring Recommendations

Alert on any modification to surveymenu_entries records by accounts other than dedicated administrators.
Monitor administrative session activity for outbound requests to unknown domains that could indicate cookie exfiltration.
Track privilege assignments so that grants of the settings:read permission are reviewed and audited.

How to Mitigate CVE-2026-15973

Immediate Actions Required

Restrict the settings:read global permission to trusted administrators until a fixed release is deployed.
Audit the surveymenu_entries table and remove any records containing HTML or JavaScript payloads.
Enforce a strict Content Security Policy (CSP) on LimeSurvey administrative routes to limit inline script execution.

Patch Information

Monitor the GitHub LimeSurvey Repository and the Fluid Attacks Security Advisory for a fixed release addressing CVE-2026-15973. Upgrade LimeSurvey Community Edition 7.0.5 to the vendor-supplied patched version as soon as it becomes available. Validate that the fix applies attribute-context encoding to the data field before rendering.

Workarounds

Remove non-essential accounts from the settings:read global permission group.
Front the LimeSurvey administrative interface with a reverse proxy that filters HTML metacharacters submitted to menu entry endpoints.
Enforce network-level access controls that restrict the administration panel to trusted management networks or VPN users.

bash

# Example nginx reverse proxy restriction for /admin
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    proxy_pass http://limesurvey_backend;
}