A server‑side request forgery flaw exists in the REST API survey template endpoint of LimeSurvey. The vulnerability arises from the unsanitized use of the HTTP Host header within the getTemplateData() function, allowing an attacker to instruct the server to issue arbitrary HTTP requests to any host chosen by the attacker. Because these requests are made from the server’s context, an attacker can reach internal network resources, cloud metadata services, and subsequently harvest sensitive credentials such as IAM tokens. The impact is a breach of confidentiality and potential privilege escalation if the extracted credentials are used externally.

The flaw affects LimeSurvey versions up to 6.17.10 and 7.0.4. Administrators running any of these releases must verify their version and consider upgrading as soon as a patch becomes available.

The CVSS score of 6.3 reflects a moderate severity, and the EPSS score of < 1% indicates a very low, but non‑zero probability of exploitation. The vulnerability requires an authenticated user to exploit the REST API, suggesting that it is not a purely public exploit but could be leveraged by compromised or legitimate accounts. The exploit path involves sending a crafted Host header to the getTemplateData() endpoint, forcing the server to connect to arbitrary destinations, which can be used to extract credentials and potentially pivot into further compromise. With the low EPSS score and absence from the CISA KEV catalog, monitoring and a timely patch are advised.