CVE-2026-91775 — LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

CVE-2026-91775

LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings PUBLISHED

Description (CNA)

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

Affected (CNA)

Vendor / product	Versions
LimeSurvey / LimeSurvey	affected 7.0.14

CWE

CWE-79

References

https://fluidattacks.com/advisories/alone
https://github.com/LimeSurvey/LimeSurvey
https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651

ADP enrichment

CISA-ADP

No English description supplied.

https://fluidattacks.com/advisories/alone