LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Limesurvey |
|
No data.
No data.
References
History
Mon, 20 Jul 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Limesurvey
Limesurvey limesurvey |
|
| Vendors & Products |
Limesurvey
Limesurvey limesurvey |
Mon, 20 Jul 2026 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services. | |
| Title | LimeSurvey SSRF via REST API Survey Template Host Header | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-07-20T18:14:01.625Z
Updated: 2026-07-20T18:14:01.625Z
Reserved: 2026-07-15T15:45:44.602Z
Link: CVE-2026-63107
Vulnrichment
No data.
NVD
No data.
Redhat
No data.