CVE-2025-56422: 
NixOS vulnerability analysis and mitigation

CVE-2025-56422 is a critical deserialization vulnerability in LimeSurvey that allows a remote attacker to execute arbitrary code on the server without authentication. It affects all LimeSurvey versions prior to v6.15.0+250623 (up to and including v6.14.3). The vulnerability was published on March 10, 2026, and is classified as CWE-502 (Deserialization of Untrusted Data). It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, Security Advisory).

The root cause is improper handling of user-controlled serialized input (CWE-502), which allows an attacker to supply a specially crafted serialized object that triggers arbitrary code execution within the LimeSurvey application context. The attack vector is network-based, requires no privileges and no user interaction, making it exploitable by any unauthenticated remote attacker. The vulnerability is also mapped to CAPEC-586 (Object Injection), indicating the attacker can inject malicious objects through the deserialization process to manipulate application logic or execute system commands (Security Advisory, Red Hat Advisory).

Successful exploitation grants an unauthenticated remote attacker arbitrary code execution on the affected LimeSurvey server, resulting in critical impact to confidentiality, integrity, and availability. An attacker could exfiltrate sensitive survey data and respondent information, tamper with survey content, establish persistent backdoor access, or pivot to other systems within the network. The complete compromise of the server is possible without any user interaction or prior authentication (Security Advisory, Red Hat Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.134%, reflecting a currently low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported at this time.

1. Reconnaissance: Identify internet-facing LimeSurvey instances running versions prior to v6.15.0+250623 using tools like Shodan, Censys, or targeted web crawling for LimeSurvey-specific paths (e.g., /index.php/admin).
2. Identify deserialization endpoint: Locate the application endpoint or parameter that accepts and processes serialized PHP or other serialized data objects without proper validation.
3. Craft malicious payload: Using a PHP object injection tool (e.g., PHPGGC), generate a serialized gadget chain payload targeting available PHP classes in the LimeSurvey application context that can trigger OS command execution upon deserialization.
4. Submit payload: Send the crafted serialized object to the vulnerable endpoint via an HTTP request (e.g., POST parameter, cookie, or header), requiring no authentication.
5. Achieve code execution: The server deserializes the malicious object, triggering the gadget chain and executing attacker-controlled commands as the web server process user, enabling reverse shell establishment, data exfiltration, or further lateral movement (Security Advisory).

• Network: Unusual or malformed POST requests to LimeSurvey endpoints containing serialized PHP object patterns (e.g., strings beginning with O:, a:, or base64-encoded variants); unexpected outbound connections from the web server to external IPs.
• Logs: Web server access logs showing requests with abnormally large or encoded body content to LimeSurvey endpoints; PHP error logs referencing unexpected class instantiation or deserialization errors.
• File System: Newly created PHP web shells or unexpected scripts in the LimeSurvey installation directory or upload folders; modification timestamps on core LimeSurvey files inconsistent with the installed version.
• Process: Unusual child processes spawned by the web server process (e.g., php, apache2, nginx) such as bash, sh, curl, wget, or python; unexpected cron jobs or scheduled tasks added under the web server user account.

The vendor has released a fix in LimeSurvey v6.15.0+250623; all installations running versions up to and including v6.14.3 should be upgraded immediately (Security Advisory). If immediate patching is not feasible, restrict network access to LimeSurvey instances to trusted IP addresses only and deploy Web Application Firewall (WAF) rules to detect and block suspicious serialized payloads. Additionally, isolate affected LimeSurvey systems from critical internal infrastructure and monitor server logs closely for signs of exploitation attempts until patching is completed (Red Hat Advisory).