CVE-2025-34120

🗓️ 16 Jul 2025 21:05:34Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 14 Views🌐 WEB

Unauthenticated file download vulnerability in LimeSurvey 2.0+ allows attackers to access arbitrary files.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-34120	29 May 201815:50	–	circl
CNNVD	LimeSurvey 安全漏洞	16 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-34120 LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload	16 Jul 202521:05	–	cvelist
EUVD	EUVD-2025-21750	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34120	16 Jul 202521:15	–	nvd
OpenVAS	LimeSurvey 2.05x < 2.06+ Multiple Vulnerabilities	13 May 201600:00	–	openvas
Positive Technologies	PT-2025-29883 · Unknown · Limesurvey	16 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34120	18 Jul 202521:58	–	redhatcve
Vulnrichment	CVE-2025-34120 LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload	16 Jul 202521:05	–	vulnrichment

Vulners

CNA

Node

limesurvey_gmbh limesurveyRange2.0+–2.06+

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "admin/update/sa/backup"
    ],
    "product": "LimeSurvey",
    "vendor": "LimeSurvey GmbH",
    "versions": [
      {
        "lessThanOrEqual": "2.06+ Build 151014",
        "status": "affected",
        "version": "2.0+",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/limesurvey_file_download.rb
packetstorm	www.packetstorm.news/files/id/180855
vulncheck	www.vulncheck.com/advisories/limesurvey-unauthenticated-arbitrary-file-download
sec-consult	www.sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/
web	www.web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015

Parameter	Position	Path	Description	CWE
datasupdateinfo	request body	index.php/admin/update/sa/backup	Unauthenticated arbitrary file read via serialized input to admin backup endpoint, allowing download of files via ZIP archive.	CWE-306, CWE-22

15 Apr 2026 00:35Current

7.1High risk

Vulners AI Score7.1

CVSS 48.7

EPSS0.69939

SSVC