CVE-2025-41076

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-41076
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41076.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-41076
Aliases
Published
2025-11-20T12:52:25.797Z
Modified
2026-07-15T01:49:05.575413085Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Multiple vulnerabilities in Limesurvey
Details

In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41076.json",
    "cna_assigner": "INCIBE",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.13.0"
                },
                {
                    "last_affected": "6.13.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-209"
    ]
}
References

Affected packages

Git / github.com/limesurvey/limesurvey

Affected ranges

Type
GIT
Repo
https://github.com/limesurvey/limesurvey
Events
Introduced
7ff92032e56eefaa0c5252a81cbd6bdbb2f03deb
Last affected
7ff92032e56eefaa0c5252a81cbd6bdbb2f03deb
Database specific 
{
    "cpe": "cpe:2.3:a:limesurvey:limesurvey:6.13.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "6.13.0"
        },
        {
            "last_affected": "6.13.0"
        }
    ]
}

Affected versions

6.*
6.13.0
6.13.0+250415

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41076.json"