Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63107LimeSurvey SSRF via REST API Survey Template Host Header

High 7.7

In plain English

A high-severity server-side request forgery in LimeSurvey from LimeSurvey. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.

Affected products (as reported)

Vendor	Product	Versions
LimeSurvey	LimeSurvey	0 – through 6.17.100 – through 7.0.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/limesurvey-ssrf-via-rest-api-survey-template-host-header third-party-advisory