PT-2026-61687 · Unknown · Limesurvey

George Chen · CVE-2026-63107 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 6.x through 6.17.10 LimeSurvey versions 7.x through 7.0.4

Description Authenticated users can trigger a server-side request forgery (SSRF) by providing a manipulated Host header. This occurs due to the unsanitized use of the HTTP Host header within the getTemplateData() function in the REST API survey template endpoint. This flaw allows attackers to force the server to issue arbitrary HTTP requests, potentially enabling access to internal network services and cloud metadata endpoints to extract sensitive credentials, such as IAM tokens from instance metadata services.

Recommendations Restrict network access and monitor for abuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-63107

Affected Products

Limesurvey

References · 4

• 🔥 https://github.com/geo-chen/oss/blob/main/limesurvey.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-63107 · Security Note
• https://vulncheck.com/advisories/limesurvey-ssrf-via-rest-api-survey-template-host-header · Note
• https://twitter.com/HugoValters/status/2079431599616082115 · Twitter Post