CVE-2026-91775

UNKNOWN

Description

LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

Timeline

Published:September 23rd, 2026 6:17 PM

Last modified:September 23rd, 2026 6:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-79

References & Reports

Advisories, patches, and third-party reports

https://fluidattacks.com/advisories/alone
https://github.com/LimeSurvey/LimeSurvey
https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651
https://fluidattacks.com/advisories/alone

Source: NIST NVD · Data may lag official sources by up to one minute