CVE-2021-44967: Limesurvey

High severity, CVSS 8.8. EPSS: 13.5% chance of exploitation in the next 30 days.

A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.

Affected products

• Limesurvey Limesurvey: version 5.2.4 only

Published 2022-02-24. Last modified 2026-06-17.