CVE-2025-41076 Multiple vulnerabilities in Limesurvey
An attacker can trigger a 500 error via a malformed session cookie, exposing internal backend details like database structure and framework information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-41076?
CVE-2025-41076 is a medium-severity vulnerability in Limesurvey Limesurvey, published on 20 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.
Weakness: CWE-209
Which versions are affected by CVE-2025-41076?
1 open source package ship an affected version, including limesurvey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
limesurvey Bitnami | From 6.13.0 | 6.15.5 |
Products include Limesurvey Limesurvey.
How do I fix CVE-2025-41076?
Upgrade limesurvey to 6.15.5 or later.
Is CVE-2025-41076 being exploited?
There is no known exploitation of CVE-2025-41076 in the wild and no public exploit code.
Other vulnerabilities in Limesurvey Limesurvey
Sources
Also known as BIT-limesurvey-2025-41076, GHSA-3q6j-5f25-xfc9.