Home

Description

An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.

PUBLISHED Reserved 2025-04-15 | Published 2025-07-16 | Updated 2025-11-19 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-306 Missing Authentication for Critical Function

Product status

Default status
unaffected

2.0+ (custom)
affected

Credits

Pichaya Morimoto finder

References

web.archive.org/.../136-limesurvey-security-advisory-10-2015 vendor-advisory patch

sec-consult.com/...-critical-vulnerabilities-in-lime-survey/ third-party-advisory technical-description

raw.githubusercontent.com/...ttp/limesurvey_file_download.rb exploit

packetstorm.news/files/id/180855 exploit

www.vulncheck.com/...unauthenticated-arbitrary-file-download third-party-advisory

cve.org (CVE-2025-34120)

nvd.nist.gov (CVE-2025-34120)

Download JSON