Quick answers
- Is CVE-2025-56422 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-56422 being exploited in the wild.
- How severe is CVE-2025-56422?
- Critical severity, with a CVSS score of 9.8, published 10 March 2026.
- Which products and versions are affected?
- LimeSurvey < 6.15.0+250623.
- Is there a fix for CVE-2025-56422?
- A patch was published on 2026-03-10: Fix released in version 6.15.0+250623 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-56422 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-56422?
- Check whether you run LimeSurvey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A critical deserialization vulnerability (CWE-502) exists in LimeSurvey versions prior to 6.15.0+250623. The application improperly handles user-controlled input during the deserialization process, allowing an attacker to provide a specially crafted serialized object. This can be exploited remotely without authentication to trigger arbitrary code execution within the application context. The vulnerability is reachable over the network and poses a high risk to confidentiality, integrity, and availability. Users are advised to upgrade to version 6.15.0+250623 or later to mitigate this risk.
Affected products
- LimeSurvey LimeSurvey < 6.15.0+250623
Timeline
- 2026-03-10: advisory: Initial disclosure of CVE-2025-56422
- 2026-03-10: patched: Fix released in version 6.15.0+250623