CVE-2026-63107 in LimeSurvey
Summary
by MITRE • 07/20/2026
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within LimeSurvey's REST API implementation where the survey template endpoint fails to properly sanitize the HTTP Host header parameter. The flaw resides in the getTemplateData() function which directly uses the unvalidated Host header value without appropriate input validation or sanitization measures. This represents a classic server-side request forgery vulnerability that allows authenticated attackers to manipulate the application's behavior and potentially access internal network resources.
The technical exploitation occurs when an authenticated user crafts a malicious Host header value that points to internal services or cloud metadata endpoints. The application processes this unvalidated input and attempts to make HTTP requests to the specified host, effectively allowing attackers to bypass normal network restrictions and reach systems that should normally be isolated from external access. This vulnerability specifically affects LimeSurvey versions through 6.17.10 and 7.0.4, indicating a persistent issue in the application's API security implementation.
The operational impact of this vulnerability is significant as it enables attackers to perform reconnaissance activities against internal network services that are typically protected by firewalls or network segmentation policies. When combined with access to cloud environments, attackers can potentially extract sensitive information from instance metadata services which often contain IAM tokens and other credentials. This allows for privilege escalation and lateral movement within compromised networks, making the vulnerability particularly dangerous in enterprise environments where internal services may contain sensitive data or administrative privileges.
The vulnerability maps directly to CWE-918 Server-Side Request Forgery and aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS where attackers can use the compromised API endpoint to perform DNS resolution of internal resources. Organizations should implement input validation controls that sanitize all HTTP headers, particularly the Host header, before processing them in any network requests. Network segmentation should be enforced to prevent unauthorized access to internal services even when such vulnerabilities are present. Additionally, implementing proper API rate limiting and monitoring for unusual request patterns can help detect exploitation attempts. The recommended mitigation includes upgrading to patched versions of LimeSurvey where the Host header is properly sanitized, implementing web application firewalls to filter malicious requests, and conducting regular security assessments of API endpoints to identify similar input validation vulnerabilities.