CVE-2026-116645
LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.
| CWE | CWE-89 |
| Vendor | limesurvey |
| Product | limesurvey community edition |
| Published | Nov 11, 2026 |
| Last Updated | Nov 11, 2026 |
Get instant alerts for limesurvey limesurvey community edition
Be the first to know when new unknown vulnerabilities affecting limesurvey limesurvey community edition are published — delivered to Slack, Telegram or Discord.