# CVE-2025-56422: LimeSurvey unsafe deserialization remote code execution

Source: https://junglewise.ai/threats/cve-2025-56422-limesurvey-unsafe-deserialization-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-56422 · Severity: critical · CVSS 9.8 · Published 2026-03-10

LimeSurvey, a popular open-source online survey application, contains a critical security flaw that allows unauthorized individuals to take control of the server. By sending a specially crafted request, an attacker can execute their own commands, potentially leading to the theft of survey data, modification of results, or a complete shutdown of the service. Organizations using LimeSurvey should update to the latest version immediately to protect their data and operations.

Technologies: [LimeSurvey](https://junglewise.ai/threats/technologies/limesurvey). Vendors: [LimeSurvey](https://junglewise.ai/threats/vendors/limesurvey).

## Quick answers

**Is CVE-2025-56422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-56422 being exploited in the wild.

**How severe is CVE-2025-56422?** Critical severity, with a CVSS score of 9.8, published 10 March 2026.

**Which products and versions are affected?** LimeSurvey < 6.15.0+250623.

**Is there a fix for CVE-2025-56422?** A patch was published on 2026-03-10: Fix released in version 6.15.0+250623 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-56422 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-56422?** Check whether you run LimeSurvey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical deserialization vulnerability (CWE-502) exists in LimeSurvey versions prior to 6.15.0+250623. The application improperly handles user-controlled input during the deserialization process, allowing an attacker to provide a specially crafted serialized object. This can be exploited remotely without authentication to trigger arbitrary code execution within the application context. The vulnerability is reachable over the network and poses a high risk to confidentiality, integrity, and availability. Users are advised to upgrade to version 6.15.0+250623 or later to mitigate this risk.

## Affected products

- LimeSurvey LimeSurvey < 6.15.0+250623

## Timeline

- 2026-03-10: advisory: Initial disclosure of CVE-2025-56422
- 2026-03-10: patched: Fix released in version 6.15.0+250623

## References

- [https://github.com/hongancalif/security-advisories/blob/main/CVE-2025-56422.md](https://github.com/hongancalif/security-advisories/blob/main/CVE-2025-56422.md)

## Related threats

- [LimeSurvey SSRF in REST API survey template endpoint](https://junglewise.ai/threats/cve-2026-63107-limesurvey-ssrf-in-rest-api-survey-template-endpoint)
- [LimeSurvey SQL injection in RemoteControl API participant methods](https://junglewise.ai/threats/cve-2026-50636-limesurvey-sql-injection-in-remotecontrol-api-participant-methods)
- [LimeSurvey host header injection in password reset](https://junglewise.ai/threats/cve-2026-50635-limesurvey-host-header-injection-in-password-reset)
- [Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code…](https://junglewise.ai/threats/cve-2025-70797-cross-site-scripting-vulnerability-in-limesurvey-v-6-15-20-251021)
- [A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of…](https://junglewise.ai/threats/cve-2025-63238-a-reflected-cross-site-scripting-xss-affects-limesurvey-versions)