High · 7.4 CVE-2026-91775 EUVD-2026-85427GHSA-cjg2-mvj3-g74m

LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

Published Sep 23, 2026 · Updated Oct 2, 2026 · Assigned by Fluid Attacks

Description

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

Affected products

Vendor	Product	Affected	Fixed
LimeSurvey	LimeSurvey	7.0.14	—

References

https://fluidattacks.com/advisories/alone third-party-advisory
https://github.com/LimeSurvey/LimeSurvey product
https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651 patch