CVE-2026-16809 Overview
CVE-2026-16809 is a stored cross-site scripting (XSS) vulnerability in LimeSurvey Community Edition 7.0.5. The flaw resides in the survey quota creation workflow, where authenticated low-privileged users can inject malicious JavaScript into a quota message. The payload is persisted server-side and executed in the browser of any user who subsequently renders the affected quota content. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and requires only the standard privilege of creating and managing a survey.
Critical Impact
An authenticated attacker with survey-creation rights can execute arbitrary JavaScript in the browser context of higher-privileged users, enabling session theft, administrative action forgery, and account takeover.
Affected Products
- LimeSurvey Community Edition 7.0.5
- Survey quota management component
- Web front-end rendering quota messages
Discovery Timeline
- 2026-08-26 - CVE CVE-2026-16809 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-16809
Vulnerability Analysis
The vulnerability exists in LimeSurvey's quota configuration feature. Survey quotas allow administrators to cap responses and display a message when a limit is reached. LimeSurvey stores the quotals_message field without sufficient output encoding when it is later rendered. An authenticated low-privileged user who owns a survey can save a quota message containing a JavaScript payload. When another user, including administrators or respondents, views the affected quota page, the browser executes the stored script under the LimeSurvey origin.
Because the payload runs in the victim's session context, the attacker can read the DOM, extract session cookies not marked HttpOnly, invoke CSRF-authenticated administrative endpoints, or pivot to broader account compromise. Exploitation requires user interaction to trigger the quota rendering path, but the trigger is a routine survey workflow.
Root Cause
The root cause is missing or insufficient contextual output encoding of user-supplied quota message content before insertion into the HTML response. LimeSurvey trusts a field editable by non-administrative users and renders it into a page context where script tags and event handlers execute. Input validation on the write path does not strip or neutralize HTML, and the read path does not apply an HTML-safe escaping filter.
Attack Vector
An attacker authenticates with a low-privileged account that has permission to create surveys. The attacker navigates to the quota management interface for a survey they own and injects a JavaScript payload into the quota message field via the standard save operation. The payload persists in the database. When any user, including a global administrator, opens the quota page or triggers the quota-reached message, the script executes in their browser.
Because user interaction (UI:A) is required, exploitation is typically staged by inviting a higher-privileged reviewer to inspect the survey, or by allowing quota-triggered navigation during normal respondent testing. See the Fluid Attacks Security Advisory for advisory details and the GitHub LimeSurvey Repository for source context.
No verified public proof-of-concept code is available. The vulnerability mechanism follows a standard stored-XSS pattern: unsanitized persistence of user-controlled input, followed by unescaped rendering in an HTML context.
Detection Methods for CVE-2026-16809
Indicators of Compromise
- Quota message records containing HTML tags such as <script>, <img onerror=, <svg onload=, or javascript: URIs in the LimeSurvey quota_languagesettings table.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after opening a survey quota page.
- Unexpected session or CSRF token values appearing in web server access logs from third-party referrers.
- Creation of new administrative accounts or permission changes correlated with an admin session viewing a low-privilege user's survey.
Detection Strategies
- Review LimeSurvey database entries for quota message fields containing HTML or JavaScript syntax and quarantine suspicious rows.
- Deploy a web application firewall (WAF) rule that inspects POST bodies to quota management endpoints for script tags and event-handler attributes.
- Enable and monitor Content Security Policy (CSP) violation reports to detect inline script execution on LimeSurvey admin pages.
- Correlate low-privilege user quota-edit events with subsequent administrator page views of the same survey.
Monitoring Recommendations
- Log all writes to the LimeSurvey quota configuration API and alert on payloads containing HTML control characters.
- Monitor administrator session behavior for anomalous API calls originating immediately after quota page loads.
- Track failed CSP directives on the LimeSurvey origin and treat repeated violations from the same session as a compromise indicator.
How to Mitigate CVE-2026-16809
Immediate Actions Required
- Upgrade LimeSurvey Community Edition beyond 7.0.5 as soon as a fixed release is published by the vendor. Track the GitHub LimeSurvey Repository for patch commits.
- Audit existing quota messages across all surveys and remove any content containing HTML tags or JavaScript syntax.
- Restrict survey creation privileges to trusted users until a patched version is deployed.
- Force password rotation and session invalidation for administrator accounts that may have viewed attacker-controlled quotas.
Patch Information
At the time of publication, no specific fixed version is referenced in the CVE record. Administrators should consult the Fluid Attacks Security Advisory and the vendor's release notes for the patched version and apply it in accordance with organizational change management policy.
Workarounds
- Apply a strict Content Security Policy that disallows inline scripts (script-src 'self') on the LimeSurvey application origin.
- Place LimeSurvey behind a WAF configured to block HTML and JavaScript payloads submitted to quota management endpoints.
- Temporarily revoke the survey creation permission from non-administrative roles via the LimeSurvey global permissions interface.
- Instruct administrators to avoid opening quota pages on surveys owned by untrusted users until the patch is applied.
# Example CSP header to mitigate stored XSS execution on LimeSurvey
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
