Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-21 | 1 | Patch1 |
| 2026-07-31 | 1 | Disclosure1 |
🚨 HIGH: CVE-2026-63107 (CVSS 7.7) - SSRF in LimeSurvey ≤6.17.10 & 7.0.4 REST API. Authenticated attackers can reach internal services & extract cloud IAM tokens via manipulated Host header. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/N318tlFZa8
Post summary
The tweet announces CVE-2026-63107, an SSRF flaw in LimeSurvey with a CVSS score of 7.7, and urges immediate patching.
#CVE-2026-63107 - #SSRF in Limesurvey. Authenticated users can abuse Host header in REST API to access internal services and cloud metadata. #CVSS 7.7. No patch yet - restrict network access and monitor for abuse. #CVEAlert #Limesurvey #infosec #cybersecurity #cybersecuritytips https://www.valtersit.com/cve/CVE-2026-63107
Post summary
An SSRF vulnerability (CVE‑2026‑63107) in Limesurvey’s REST API allows authenticated users to abuse the Host header to access internal services. While no patch is currently available, network restrictions and monitoring are recommended as mitigations.