{"affected":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","source":"CNA: Fluid Attacks","vendor":"LimeSurvey","versions":[{"status":"affected","version":"7.8.0"}]}],"cveId":"CVE-2026-116645","cwes":["CWE-89"],"description":"LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: Fluid Attacks","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794365453016,"publishedAt":1794365234028,"references":[{"source":"CNA: Fluid Attacks","tags":["third-party-advisory"],"url":"https://fluidattacks.com/es/advisories/pantera"},{"source":"CNA: Fluid Attacks","tags":["product"],"url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/admin/import_helper.php"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/export_helper.php"}],"remediation":[{"kind":"fix","source":"CNA: Fluid Attacks","text":"Apply an upstream patch that strictly validates imported participant attribute identifiers and always quotes schema-derived identifiers before constructing the SPSS export SELECT list. Upgrade to the vendor-fixed release once one is published."},{"kind":"workaround","source":"CNA: Fluid Attacks","text":"Do not grant untrusted accounts global survey-creation permission and do not import untrusted .lsa archives. Review imported participant-table schemas for unexpected attribute column names."}],"revision":"7352953bbf33b90b5336e67ddcbbe48ed33a832fcd4a1a0ad19ee09c6478eb9d","sources":[{"modifiedAt":1794365453016,"name":"CNA: Fluid Attacks","retrievedAt":1794366504548,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116645"}],"ssvc":null,"status":"published","title":"LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes","updatedAt":1794366504548}