CVE-2025-34120

An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.

CVSS

No CVSS.

References

Link	Resource
https://packetstorm.news/files/id/180855
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/limesurvey_file_download.rb
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/
https://web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015
https://www.vulncheck.com/advisories/limesurvey-unauthenticated-arbitrary-file-download

Configurations

No configuration.

History

17 Jul 2025, 21:15

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de descarga de archivos no autenticados en las versiones de LimeSurvey desde la 2.0+ hasta la 2.06+ (Build 151014, incluida). La aplicación no valida la entrada serializada en el endpoint de la copia de seguridad del administrador (`index.php/admin/update/sa/backup`), lo que permite a los atacantes especificar rutas de archivo arbitrarias mediante un payload `datasupdateinfo` manipulado. Los archivos se empaquetan en un archivo ZIP y se pueden descargar sin autenticación. Esta vulnerabilidad puede explotarse para leer archivos arbitrarios en el sistema host, incluyendo archivos confidenciales del sistema operativo y de configuración.

16 Jul 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-16 21:15

Updated : 2025-07-17 21:15

NVD link : CVE-2025-34120

Mitre link : CVE-2025-34120

CVE.ORG link : CVE-2025-34120

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-34120", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-16T21:15:26.960", "references": [{"url": "https://packetstorm.news/files/id/180855", "source": "disclosure@vulncheck.com"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/limesurvey_file_download.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/limesurvey-unauthenticated-arbitrary-file-download", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files."}, {"lang": "es", "value": "Existe una vulnerabilidad de descarga de archivos no autenticados en las versiones de LimeSurvey desde la 2.0+ hasta la 2.06+ (Build 151014, incluida). La aplicaci\u00f3n no valida la entrada serializada en el endpoint de la copia de seguridad del administrador (`index.php/admin/update/sa/backup`), lo que permite a los atacantes especificar rutas de archivo arbitrarias mediante un payload `datasupdateinfo` manipulado. Los archivos se empaquetan en un archivo ZIP y se pueden descargar sin autenticaci\u00f3n. Esta vulnerabilidad puede explotarse para leer archivos arbitrarios en el sistema host, incluyendo archivos confidenciales del sistema operativo y de configuraci\u00f3n."}], "lastModified": "2025-07-17T21:15:50.197", "sourceIdentifier": "disclosure@vulncheck.com"}