LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

Description

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.

An attacker does not need a LimeSurvey account. By sending a crafted URL to a user who is authenticated and has the global users:update permission, the attacker can cause arbitrary JavaScript to execute in that user's LimeSurvey origin. The issue can affect user-management administrators and may allow actions or data access available to the victim's session.

Vulnerability

Root cause

1. The endpoint accepts a client-controlled action parameter:

2. The value is inserted into an HTML attribute without context-appropriate encoding:

   <input type="hidden" name="action" value="<?= $action ?>" />

   <input type="hidden" name="action" value="<?= $action ?>" />

   <input type="hidden" name="action" value="<?= $action ?>" />

   <input type="hidden" name="action" value="<?= $action ?>" />

3. The response is fetched by the browser and inserted into the modal with .html(html). A quote can therefore terminate the value attribute and add an executable HTML element.

Source-to-sink path

1. Source: the unauthenticated attacker controls the action query parameter in a GET request.

2. Authorization gate: the victim's session must have the global users:update permission. The attacker does not need that permission or an account.

3. Controller: UserManagementController::actionActivationConfirm() copies action into $aData without allowlisting it to activate or deactivate.

4. View: confirmuseractivation.php inserts $action into the value attribute of a hidden form input without output encoding.

5. Browser sink: the user-management JavaScript loads the endpoint response into the modal using jQuery .html(), which parses the injected markup.

Impact

Successful exploitation executes arbitrary JavaScript in the victim's authenticated LimeSurvey administration context. Depending on the victim's permissions, this can expose user-management data, perform same-origin requests, modify administrative state, or perform other actions available to the victim.

The attacker only needs to deliver or induce a privileged victim to open the crafted URL. No stored content, CSRF token, or attacker account is required for the reflected XSS request.

PoC

Preconditions

• LimeSurvey Community Edition 7.0.5+260623.

• A victim is authenticated to the administration panel.

• The victim has the global users:update permission.

Reproduction

1. Deploy LimeSurvey and authenticate as an administrator or as a test user with the global users:update permission.

2. While that session is active, open the following URL. Replace the host and userid as needed:

   http://127.0.0.1:8081/index.php/userManagement/activationConfirm?userid=2&action=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%27Pwned-action-field%27%29%3E%3Cinput%20x%3D%22

   http://127.0.0.1:8081/index.php/userManagement/activationConfirm?userid=2&action=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%27Pwned-action-field%27%29%3E%3Cinput%20x%3D%22

   http://127.0.0.1:8081/index.php/userManagement/activationConfirm?userid=2&action=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%27Pwned-action-field%27%29%3E%3Cinput%20x%3D%22

   http://127.0.0.1:8081/index.php/userManagement/activationConfirm?userid=2&action=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%27Pwned-action-field%27%29%3E%3Cinput%20x%3D%22

3. The endpoint returns the confirmation fragment. The response contains markup equivalent to:

   <input type="hidden" name="action" value=""><img src=x onerror=alert('Pwned-action-field')><input x="" />

   <input type="hidden" name="action" value=""><img src=x onerror=alert('Pwned-action-field')><input x="" />

   <input type="hidden" name="action" value=""><img src=x onerror=alert('Pwned-action-field')><input x="" />

   <input type="hidden" name="action" value=""><img src=x onerror=alert('Pwned-action-field')><input x="" />

Expected result:

• A browser dialog displays Pwned-action-field.

• The JavaScript executes in the LimeSurvey administration origin and in the victim's authenticated browser context.

Negative control

With a value that does not break out of the attribute, such as action=activate, the endpoint renders the normal activation confirmation and no injected element is created.

Evidence of Exploitation

• Video of exploitation:

  

• Static evidence:

  

Our security policy

We have reserved the ID CVE-2026-63360 to refer to this issue from now on.

Disclosure policy

System Information

• LimeSurvey

• Version: 7.0.5

• Operating System: Any

References

• GitHub Repository: https://github.com/LimeSurvey/LimeSurvey/

• Security: https://github.com/LimeSurvey/LimeSurvey/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Miguel Gomez from Fluid Attacks' Offensive Team using the AI SAST Scanner.