CVE-2021-44967
HIGH 9.0EPSS 13.5%
A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 13.50% chance of exploitation in the next 30 days, 96th percentile
- Published
- 2022-02-22
- Updated
- 2025-02-20
Proof-of-concept exploits (6)
- Y1LD1R1M-1337/Limesurvey-RCE25★ · 2023-07-16
- https://www.exploit-db.com/exploits/50573
- D3Ext/CVE-2021-449676★ · 2025-08-11
- godylockz/CVE-2021-449671★ · 2025-02-17
- monke443/CVE-2021-449671★ · 2025-04-18
- kikechans/-Limesurvey-RCE-CVE-2021-44967