CVE-2020-11455: 
NixOS vulnerability analysis and mitigation

LimeSurvey before version 4.1.12+200324 contained a path traversal vulnerability in the application/controllers/admin/LimeSurveyFileManager.php component. The vulnerability was discovered and disclosed on April 1, 2020, and was assigned the identifier CVE-2020-11455 (CVE Mitre).

The vulnerability exists within the 'File Manager' functionality of LimeSurvey. The issue stems from improper validation of the 'path' parameter in the file manager component, which could allow an attacker to traverse directory paths (Exploit DB).

When exploited, this vulnerability allows an attacker to download arbitrary files from the system. Additionally, the file manager functionality will delete the file after it is downloaded (if the web service account has sufficient permissions), potentially enabling attackers to cause a denial of service by targeting critical LimeSurvey configuration files (Exploit DB).

The vulnerability was patched in LimeSurvey version 4.1.12+200324. The fix involved changing how file paths are handled by implementing session-based path storage instead of direct path parameters (GitHub Commit).