LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering

Description

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message.

The vulnerable workflow saves attacker-controlled quota language settings before applying the model validation that normally performs XSS filtering. The public quota page later renders the persisted quota message as active HTML when a participant reaches the matching quota condition.

Successful exploitation allows attacker-controlled JavaScript to execute in LimeSurvey's origin. If the victim is an authenticated administrator or superadministrator, the script can perform same-origin administrative actions in that victim's session, including creating an attacker-controlled privileged account.

Vulnerability

Root Cause

1. Low-privileged survey owner reaches quota creation

   QuotasController::actionAddNewQuota($surveyid) requires only quotas:create for the target survey:

   A user with global surveys:create can create a survey they own and receive the permissions needed to manage quotas for that survey.

2. Attacker-controlled quota message is mass-assigned

   Quotas::saveNewQuota() reads posted QuotaLanguageSetting values and assigns them to a new QuotaLanguageSetting model:

   The attacker-controlled source is:

   QuotaLanguageSetting[<language>

   QuotaLanguageSetting[<language>

   QuotaLanguageSetting[<language>

   QuotaLanguageSetting[<language>

3. The unsafe value is saved before validation

   The method decodes entities and normalizes CKEditor markup, then saves without validation:

   This bypasses the LSYii_Validators rule on quotals_message. Even when validation later sanitizes the in-memory attribute, the sanitized value is not persisted back to lime_quota_languagesettings.

4. The stored value reaches the public quota page

   When the survey response matches a quota condition, Quotas::checkCompletedQuota() loads the stored quota data and assigns the message to the survey view model:

5. The quota template renders the message as active HTML

   The default survey templates insert the message into the quota page:

   <div class='{{ aSurveyInfo.class.quotamessage }}' {{ aSurveyInfo.attr.quotamessage }}>
       {{ aSurveyInfo.aQuotas.sMessage  }}
   </div>

   <div class='{{ aSurveyInfo.class.quotamessage }}' {{ aSurveyInfo.attr.quotamessage }}>
       {{ aSurveyInfo.aQuotas.sMessage  }}
   </div>

   <div class='{{ aSurveyInfo.class.quotamessage }}' {{ aSurveyInfo.attr.quotamessage }}>
       {{ aSurveyInfo.aQuotas.sMessage  }}
   </div>

   <div class='{{ aSurveyInfo.class.quotamessage }}' {{ aSurveyInfo.attr.quotamessage }}>
       {{ aSurveyInfo.aQuotas.sMessage  }}
   </div>

Impact

An authenticated low-privileged LimeSurvey user can persist JavaScript in a survey quota message and trigger execution when another user reaches that quota page.

Potential impact includes:

• JavaScript execution in the browser of public survey respondents.

• Same-origin actions in any authenticated LimeSurvey session that visits the affected survey.

• Administrative account creation or permission changes if a superadministrator is targeted.

• Unauthorized access to, or modification of, LimeSurvey data available to the victim session.

The issue requires authentication to create the malicious survey/quota, but it does not require administrator privileges.

PoC

Preconditions

• LimeSurvey Community Edition 7.0.5+260623.

• Application reachable at http://127.0.0.1:8081.

• Initial administrator credentials:

  admin / password

  admin / password

  admin / password

  admin / password

• A low-privileged attacker account with surveys:create.

• Burp listening on http://127.0.0.1:8080 if proxying the supplied PoC script.

Step 1 - Deploy the application

Download:

https://download.limesurvey.org/latest-master/limesurvey7.0.5+260623.zip

https://download.limesurvey.org/latest-master/limesurvey7.0.5+260623.zip

https://download.limesurvey.org/latest-master/limesurvey7.0.5+260623.zip

https://download.limesurvey.org/latest-master/limesurvey7.0.5+260623.zip

Deploy LimeSurvey with PHP/Apache and MariaDB/MySQL. Complete the installer using:

Database type: MySQL
MariaDB/MySQL database engine type: InnoDB
Database location: db
Database user: limesurvey
Database password: limesurvey_local
Database name: limesurvey
Table prefix: lime_
Administrator email address: admin@test.com

Database type: MySQL
MariaDB/MySQL database engine type: InnoDB
Database location: db
Database user: limesurvey
Database password: limesurvey_local
Database name: limesurvey
Table prefix: lime_
Administrator email address: admin@test.com

Database type: MySQL
MariaDB/MySQL database engine type: InnoDB
Database location: db
Database user: limesurvey
Database password: limesurvey_local
Database name: limesurvey
Table prefix: lime_
Administrator email address: admin@test.com

Database type: MySQL
MariaDB/MySQL database engine type: InnoDB
Database location: db
Database user: limesurvey
Database password: limesurvey_local
Database name: limesurvey
Table prefix: lime_
Administrator email address: admin@test.com

Step 2 - Create the attacker-owned survey and quota

As the low-privileged attacker:

1. Create a new survey.

2. Add a mandatory dropdown question with one answer option, for example:

   Option A

   Option A

   Option A

   Option A

3. Create a quota for the survey with:

   qlimit: 0
   action: terminate
   active: 1

   qlimit: 0
   action: terminate
   active: 1

   qlimit: 0
   action: terminate
   active: 1

   qlimit: 0
   action: terminate
   active: 1

4. Store an XSS payload in the quota message:

   <img src=x onerror="alert(document.domain)">

   <img src=x onerror="alert(document.domain)">

   <img src=x onerror="alert(document.domain)">

   <img src=x onerror="alert(document.domain)">

5. Associate Option A with the quota.

6. Activate the survey in open-access mode.

Step 3 - Trigger the quota page

As the victim:

1. Open the public survey URL.

2. Click Next.

3. Select Option A.

4. Submit the survey.

Expected result:

• The quota page is displayed.

• The stored quota message is emitted as HTML.

• The <img> onerror handler executes in LimeSurvey's origin.

Step 4 - Administrator-session impact

The supplied PoC extends the payload to run in an authenticated administrator victim session. It creates an attacker-controlled user and assigns global administrative permissions through same-origin POST requests.

Expected result:

• The browser title changes to the marker printed by the PoC.

• The attacker-controlled account appears in LimeSurvey User Management with elevated permissions.

Evidence of Exploitation

• Video of exploitation:

  

• Static evidence:

  

Our security policy

We have reserved the ID CVE-2026-16809 to refer to this issue from now on.

Disclosure policy

System Information

• LimeSurvey

• Version: 7.0.5

• Operating System: Any

References

• GitHub Repository: https://github.com/LimeSurvey/LimeSurvey/

• Security: https://github.com/LimeSurvey/LimeSurvey/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Miguel Gomez from Fluid Attacks' Offensive Team using the AI SAST Scanner.