CVE-2026-63107CWE-918

LimeSurvey SSRF via REST API Survey Template Host Header

Medium · published July 20, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-20T18:14Z
EPSS history
Timeline
  • 20 JUL 18:14Z
    LimeSurvey SSRF via REST API Survey Template Host Header
    cvelistv5