CVE-2025-41375 is a critical SQL injection (CVSS 9.8) in LimeSurvey v2.65.1+170522. The token parameter of the index page lets an attacker read and change the database. INCIBE reports the LimeSurvey team fixed it in version 3.0.0, so upgrade old installs.
What's affected
The CVE record names LimeSurvey v2.65.1+170522 and the token parameter of the /index.php endpoint. INCIBE describes the affected scope as LimeSurvey prior to v3.0.
According to INCIBE, the LimeSurvey team fixed the problem in version 3.0.0. A second CVE, CVE-2025-41376, covers a CRLF injection in the same version and is rated medium.
This is an old release line. The version string ends in 170522, which looks like a 2017 build date, so the question for most teams is why a survey server is still on it.
How to check if you're exposed
Check the version in the LimeSurvey admin interface, where it appears in the footer or the about screen. If it shows 2.x, you are well behind and affected.
If you cannot sign in, look at the application files on the server. Your deployment records should say which release was installed.
Then check how the survey is reached. Survey links with a token in the URL are often sent to the public by email. Search web logs for requests to the survey index path with unusual token values and for repeated server errors from that route.
What to do now
- Find every LimeSurvey install and note the version, including old ones that were meant to be retired.
- Upgrade to 3.0.0 or later, and preferably to a currently supported release.
- Take a database backup before the upgrade, and test the upgrade on a copy.
- Limit admin access to trusted networks.
- If an old server cannot be upgraded, take it offline or place it behind authentication.
Why it matters
CWE-89, SQL injection, is the cause. The token value comes from the request and is used in a database query. If it is not kept separate from the query, the sender controls part of it. The record says the attacker can retrieve, create, update and delete the database.
Survey tools hold personal data from respondents, which raises the cost of a leak beyond the software itself. This CVE is not on the CISA Known Exploited Vulnerabilities list. Old, forgotten installs are where this kind of bug survives, so the best defense is an inventory that includes them.
Try it yourself
If you build web apps, catching injection before merge is cheaper than patching after release. This demo shows a pull request gate.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-41375?
INCIBE says the LimeSurvey team fixed it in version 3.0.0. The vulnerable release named in the record is 2.65.1+170522.
Is this a recent product version?
No. The affected build string suggests a 2017 release, so most readers who find it will be looking at an old install that needs upgrading.
Sources
Last reviewed: 18 October 2026.
