High severityNVD Advisory· Published Jul 16, 2025· Updated Apr 15, 2026
CVE-2025-34120
CVE-2025-34120
Description
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (index.php/admin/update/sa/backup), allowing attackers to specify arbitrary file paths using a crafted datasupdateinfo payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2>=2.0,<=2.06+ Build 151014+ 1 more
- (no CPE)range: >=2.0,<=2.06+ Build 151014
- (no CPE)range: >=2.0, <=2.06+ Build 151014
Patches
Vulnerability mechanics
References
5- packetstorm.news/files/id/180855nvd
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/limesurvey_file_download.rbnvd
- sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/nvd
- web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015nvd
- www.vulncheck.com/advisories/limesurvey-unauthenticated-arbitrary-file-downloadnvd
News mentions
0No linked articles in our index yet.