CVE-2026-63360: LimeSurvey XSS Vulnerability

CVE-2026-63360 Overview

CVE-2026-63360 is an authenticated reflected Cross-Site Scripting (XSS) vulnerability in LimeSurvey Community Edition 7.0.5+260623. The flaw resides in the user activation confirmation endpoint, where the action query parameter is reflected into an HTML hidden input attribute without proper attribute encoding. An attacker can craft a malicious URL that injects arbitrary JavaScript into the response context of an authenticated user. Successful exploitation results in script execution in the victim's browser session against the LimeSurvey application. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, administrative action hijacking, and survey data manipulation.

Affected Products

LimeSurvey Community Edition 7.0.5+260623
LimeSurvey 7.0.5
User activation confirmation endpoint handling the action query parameter

Discovery Timeline

2026-08-26 - CVE-2026-63360 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-63360

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw in the LimeSurvey user activation confirmation flow. The affected endpoint accepts an action query parameter and copies its value directly into the response HTML. The value is placed inside a hidden <input> element attribute without applying HTML attribute encoding. Because the attribute context is not escaped, an attacker can break out of the attribute delimiter and inject arbitrary markup or event handlers.

Exploitation requires that a victim with an authenticated LimeSurvey session visits a malicious link. The injected script executes with the privileges of the authenticated user, which in survey administration contexts includes access to respondent data, survey configuration, and account settings. User interaction is required, but authentication bypass is not necessary for the attacker; only the victim must be logged in.

Root Cause

The root cause is missing output encoding at an HTML attribute sink. The application trusts a request-supplied query parameter and inlines it into a hidden input attribute value. Without contextual attribute encoding of characters such as ", ', <, and >, the parameter can terminate the attribute and introduce new attributes or <script> blocks. This is a classic instance of CWE-79 in an attribute context.

Attack Vector

An attacker crafts a URL targeting the LimeSurvey activation confirmation endpoint with a malicious action parameter value. The payload closes the surrounding attribute quotation and appends an event handler such as onmouseover or onfocus with attacker-controlled JavaScript. The attacker delivers the link through phishing, forum posts, or an attacker-controlled site. When an authenticated LimeSurvey user follows the link and interacts with the rendered page, the injected handler fires and executes JavaScript in the LimeSurvey origin.

No verified public exploit code is available. Technical details are documented in the Fluid Attacks Security Advisory and the GitHub LimeSurvey Repository.

Detection Methods for CVE-2026-63360

Indicators of Compromise

HTTP requests to the LimeSurvey user activation confirmation endpoint containing suspicious characters such as ", <, >, or on event handler prefixes inside the action query parameter.
Web server or reverse proxy logs showing long, URL-encoded action values that decode to HTML or JavaScript fragments.
Referrer chains from external domains leading authenticated LimeSurvey users to the activation endpoint with non-standard action values.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the action query parameter for HTML metacharacters and JavaScript event handler patterns.
Enable Content Security Policy (CSP) reporting to capture inline script execution violations originating from the LimeSurvey origin.
Correlate outbound browser telemetry with reflected parameters in inbound requests to identify successful script execution.

Monitoring Recommendations

Alert on HTTP 200 responses from the activation endpoint where the request query string exceeds a normal length baseline.
Monitor administrative account activity for unexpected session token reuse or configuration changes following user link clicks.
Review LimeSurvey audit logs for administrative actions triggered from unusual IP addresses or user agents shortly after phishing campaigns.

How to Mitigate CVE-2026-63360

Immediate Actions Required

Upgrade LimeSurvey Community Edition beyond version 7.0.5+260623 once a fixed release is published by the vendor.
Restrict access to the LimeSurvey administrative interface to trusted networks or VPN-only ranges until patching is complete.
Instruct administrative users to avoid clicking untrusted links while authenticated to LimeSurvey.
Rotate administrative session cookies and credentials if suspicious activity is identified.

Patch Information

Monitor the GitHub LimeSurvey Repository for a security release addressing the reflected XSS in the activation confirmation endpoint. Refer to the Fluid Attacks Security Advisory for coordinated disclosure details and vendor response tracking.

Workarounds

Configure a WAF rule to block or sanitize requests to the activation confirmation endpoint containing HTML metacharacters in the action parameter.
Enforce a strict Content Security Policy that disallows inline scripts and event handlers on LimeSurvey responses.
Require re-authentication for administrative sessions on short intervals to reduce the window for session-riding attacks.

bash

# Example WAF rule (ModSecurity) to block HTML metacharacters in the action parameter
SecRule ARGS:action "@rx [<>\"'`]|on[a-z]+\s*=" \
    "id:1026063360,phase:2,deny,status:400,\
    msg:'CVE-2026-63360 LimeSurvey reflected XSS attempt in action parameter'"