CVE-2026-65930: LimeSurvey XSS Vulnerability

CVE-2026-65930 Overview

CVE-2026-65930 is an authenticated stored cross-site scripting (XSS) vulnerability in LimeSurvey Community Edition 7.0.5. The flaw resides in the replacement-fields dialog used by the administrative question editor. An authenticated user with access to the question editor can inject persistent JavaScript that executes in the browser of other administrative users viewing the affected content. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Stored XSS in an administrative interface enables session hijacking, unauthorized actions on behalf of administrators, and pivoting into other survey management functions.

Affected Products

LimeSurvey Community Edition 7.0.5
LimeSurvey administrative question editor component
LimeSurvey replacement-fields dialog

Discovery Timeline

2026-08-26 - CVE-2026-65930 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65930

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the replacement-fields dialog rendered by the LimeSurvey administrative question editor. Input supplied through this dialog is stored server-side and later rendered without sufficient neutralization of HTML and script content. When an administrative user views survey content containing the injected payload, the browser executes attacker-supplied JavaScript in the context of the LimeSurvey administrative session.

Exploitation requires prior authentication with permissions to interact with the question editor. This raises the barrier compared to unauthenticated XSS but does not eliminate risk, because LimeSurvey deployments frequently grant editor privileges to multiple users across teams. User interaction is required for payload execution, since a victim administrator must load the affected view.

Root Cause

The root cause is improper output encoding of user-controlled data written through the replacement-fields dialog. The application stores the value and later emits it into an HTML context without escaping characters such as <, >, and quotes. This allows arbitrary markup and script tags to be interpreted by the browser rather than rendered as text.

Attack Vector

An authenticated attacker with low privileges submits a crafted payload through the replacement-fields dialog in the question editor. The payload is persisted in the database and returned to any administrator who later opens the affected question or survey. Because execution occurs inside the administrative UI, the attacker can read session tokens, issue authenticated requests, modify surveys, and exfiltrate collected response data.

Code examples are not published for this issue. Refer to the Fluid Attacks Security Advisory and the GitHub LimeSurvey Repository for further technical detail.

Detection Methods for CVE-2026-65930

Indicators of Compromise

Survey questions or replacement fields containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains after opening a survey.
New or modified survey records edited by low-privilege accounts shortly before administrator activity anomalies.

Detection Strategies

Review LimeSurvey application logs for edits to question and replacement-field records, correlating with the user identifier and timestamp.
Inspect database fields backing the question editor for stored content matching XSS payload patterns.
Monitor administrative endpoints for anomalous session activity following question editor access.

Monitoring Recommendations

Alert on Content Security Policy (CSP) violations reported by administrator browsers when accessing LimeSurvey.
Track authenticated LimeSurvey user activity for privilege changes, exported responses, or new administrative accounts.
Baseline normal editor usage and flag payload-like strings in stored survey metadata.

How to Mitigate CVE-2026-65930

Immediate Actions Required

Restrict access to the question editor to trusted administrative users only, and audit existing role assignments.
Review recently created or modified questions and replacement fields for injected HTML or script content and sanitize entries.
Rotate administrative session cookies and credentials if suspicious editor activity is identified.

Patch Information

No fixed version is listed in the NVD entry at publication. Monitor the GitHub LimeSurvey Repository and vendor release notes for a security update addressing the replacement-fields dialog. Apply the fix as soon as it is available for LimeSurvey 7.0.5.

Workarounds

Enforce a strict Content Security Policy on LimeSurvey administrative pages to block inline script execution.
Limit question editor permissions to a minimum set of vetted operators until a patch is applied.
Deploy a web application firewall rule that blocks HTML and script metacharacters submitted to the replacement-fields endpoint.

bash

# Example CSP header for the LimeSurvey admin virtual host (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;