CVE-2025-41076: 
NixOS vulnerability analysis and mitigation

CVE-2025-41076 is an information disclosure vulnerability in LimeSurvey 6.13.0 classified under CWE-209 (Generation of Error Message Containing Sensitive Information). Any external user can trigger a 500 Internal Server Error by sending a malformed session cookie, causing the application to expose internal backend details including the Yii framework, MySQL/MariaDB database engine, the lime_sessions table name, primary keys, and payload fragments. The vulnerability was published on November 20, 2025, by the Spanish National Cybersecurity Institute (INCIBE). It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (INCIBE Advisory).

The root cause is improper error handling (CWE-209): when LimeSurvey 6.13.0 receives a malformed session cookie, the Yii framework generates an unhandled exception that propagates a verbose 500 error response to the client rather than a sanitized generic message. This network-based attack requires no authentication and low complexity — an attacker simply crafts an invalid cookie value in an HTTP request to any survey endpoint. The exposed information (framework name, database engine, table schema, and conflicting content fragments) provides meaningful reconnaissance data that can facilitate follow-on attacks such as SQL injection or targeted framework exploitation (INCIBE Advisory).

Successful exploitation results in a high confidentiality impact against the application's internal architecture: attackers learn the backend framework (Yii), database engine (MySQL/MariaDB), session table name (lime_sessions), and primary key structures without any credentials. While there is no direct integrity or availability impact, the disclosed information significantly lowers the barrier for subsequent, more severe attacks such as SQL injection, session manipulation, or targeted framework-level exploits. The scope is limited to the affected LimeSurvey instance, but the reconnaissance value makes this vulnerability a meaningful stepping stone in a multi-stage attack chain (INCIBE Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-41076. The EPSS score is approximately 0.042%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and minimal technical skill — any user capable of crafting an HTTP request with a malformed cookie can trigger the information disclosure, making it trivially exploitable if targeted (INCIBE Advisory).

1. Reconnaissance: Identify a publicly accessible LimeSurvey 6.13.0 instance using search engines (e.g., Shodan, Censys) or manual browsing, looking for the default LimeSurvey login or survey pages.
2. Craft malformed cookie: Prepare an HTTP request with a deliberately malformed or corrupted PHPSESSID or LimeSurvey session cookie value (e.g., a truncated, binary-injected, or structurally invalid string that violates expected session data format).
3. Send request: Submit the HTTP GET or POST request to any LimeSurvey endpoint (e.g., /index.php) with the malformed cookie included in the Cookie header.
4. Observe error response: The server returns an HTTP 500 error page that includes verbose Yii framework exception details, revealing the database engine (MySQL/MariaDB), the lime_sessions table name, primary key fields, and fragments of the conflicting session data.
5. Leverage disclosed information: Use the exposed schema and framework details to plan targeted follow-on attacks, such as crafting SQL injection payloads against the lime_sessions table or exploiting known Yii framework vulnerabilities (INCIBE Advisory).

• Network: Repeated HTTP requests to LimeSurvey endpoints (e.g., /index.php) containing malformed or binary-injected Cookie headers from a single or rotating source IP; HTTP 500 responses returned to external clients.
• Logs: Web server access logs showing 500 status codes on survey endpoints paired with unusual Cookie header values; application error logs (Yii framework logs) recording database exceptions referencing lime_sessions table.
• Application: Yii framework exception traces appearing in HTTP response bodies rather than being suppressed; error messages containing strings such as lime_sessions, MySQL, MariaDB, or Yii visible in outbound HTTP responses.

The primary remediation is to update LimeSurvey to a version beyond 6.13.0 that addresses this error handling flaw; users should monitor the LimeSurvey changelog for a patched release. As a workaround, administrators should configure the Yii framework to suppress verbose error output in production environments by setting YII_DEBUG to false and ensuring the application runs in production mode, which replaces detailed exception pages with generic error messages. Additionally, deploying a Web Application Firewall (WAF) rule to detect and block requests with malformed cookie values can reduce exposure until a patch is applied (INCIBE Advisory).

The vulnerability was reported and coordinated by INCIBE (Spanish National Cybersecurity Institute), which published a multi-vulnerability advisory for LimeSurvey 6.13.0. No notable independent researcher commentary, social media discussion, or significant media coverage beyond standard vulnerability database aggregation has been observed for this specific CVE.