CVE-2020-36993: 
NixOS vulnerability analysis and mitigation

CVE-2020-36993 is a stored cross-site scripting (XSS) vulnerability in LimeSurvey's Survey Menu functionality within the administration panel. It affects LimeSurvey version 4.3.10 and earlier, allowing low-privileged authenticated attackers to inject malicious SVG scripts via the Surveymenu[title] and Surveymenu[parent_id] parameters. The vulnerability was formally published on January 28, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, VulnCheck Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). The SurveymenuController.php file failed to sanitize the title and description fields received via POST parameters before storing and rendering them, allowing SVG-based script payloads to persist in the database. The fix, applied in commit 3712854, added flattenText() sanitization calls to both the Surveymenu[title] and Surveymenu[description] fields in the controller, as well as to user management fields affected by related issues (#16592–#16594). A proof-of-concept exploit is publicly available on Exploit-DB (GitHub Commit, Exploit-DB).

Successful exploitation allows a low-privileged authenticated attacker to inject persistent JavaScript payloads that execute in the browser context of any administrator who views the affected Survey Menu. This can lead to session hijacking, credential theft, unauthorized administrative actions, or further compromise of the LimeSurvey instance. Because the payload is stored server-side, it executes automatically on every administrative page load without further attacker interaction (Feedly, VulnCheck Advisory).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-48762). Exploitation requires a low-privilege authenticated account on the LimeSurvey administration panel and passive user interaction (an administrator viewing the Survey Menu). The EPSS score is approximately 0.03%, indicating low observed exploitation probability. There is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog (Exploit-DB, Feedly).

1. Authenticate: Log in to the LimeSurvey administration panel with any low-privilege account that has access to the Survey Menu management functionality.
2. Navigate to Survey Menu: Access the Survey Menu creation or update form within the administration panel (typically at /index.php/admin/surveymenu/update).
3. Inject malicious payload: Submit a POST request with a crafted SVG-based XSS payload in the Surveymenu[title] or Surveymenu[description] parameter, e.g., <svg onload=alert(document.cookie)> or a more sophisticated payload to exfiltrate session tokens.
4. Payload persistence: The unsanitized input is stored in the database and rendered without encoding whenever an administrator views the Survey Menu section.
5. Trigger execution: Wait for an administrator to navigate to the affected Survey Menu page; the injected script executes in their browser context, enabling session hijacking or further administrative actions (Exploit-DB, GitHub Commit).

• Network: Unusual POST requests to /index.php/admin/surveymenu/update containing SVG tags or JavaScript event handlers (e.g., onload, onerror) in the Surveymenu[title] or Surveymenu[description] parameters.
• Logs: Web server access logs showing POST requests to the Survey Menu controller endpoint with encoded or raw XSS payloads in request bodies; unexpected outbound HTTP requests from administrator browsers to external domains after visiting the Survey Menu.
• File System / Database: Survey menu entries in the LimeSurvey database containing HTML/SVG tags or JavaScript event attributes in the title or description columns of the surveymenu table.
• Browser/Session: Unexpected session token exfiltration or administrator account actions (e.g., new user creation, permission changes) not initiated by the administrator.

Upgrade LimeSurvey to a version newer than 4.3.10, which includes the fix applied in commit 3712854a8fd8d875c67640969a1d54c4d93d3676 that adds flattenText() sanitization to the affected input fields. As an interim measure, restrict administrative panel access to trusted IP ranges using network-level controls, and limit the number of accounts with access to Survey Menu management. Monitor administrator accounts for suspicious activity such as unexpected configuration changes (GitHub Commit, VulnCheck Advisory).