High severityNVD Advisory· Published Jul 16, 2025· Updated Apr 15, 2026
CVE-2025-34120
CVE-2025-34120
Description
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (index.php/admin/update/sa/backup), allowing attackers to specify arbitrary file paths using a crafted datasupdateinfo payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- packetstorm.news/files/id/180855nvd
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/limesurvey_file_download.rbnvd
- sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/nvd
- web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015nvd
- www.vulncheck.com/advisories/limesurvey-unauthenticated-arbitrary-file-downloadnvd
News mentions
0No linked articles in our index yet.