CVE-2018-7556: Debian Linux

Critical severity, CVSS 9.1. EPSS: 2% chance of exploitation in the next 30 days.

LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file.

Affected products

• Debian Debian Linux: version 7.0 only
• Limesurvey Limesurvey: from 2.6.0, before 2.6.7 (fixed in 2.6.7); from 2.7.0, before 2.73.1 (fixed in 2.73.1); from 3.0.0, before 3.4.2 (fixed in 3.4.2)

Published 2018-02-28. Last modified 2026-06-17.