Medium
Security advisory
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-42112
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:58 UTC · Revision 1
Source evidence
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
osv:CVE-2021-42112
Complete source record
{
"id": "f595cfd52976ff0d1a6f80506d9b55fb72b6ffeea961d4fe12884e8892c9c0a2",
"url": "https://osv.dev/vulnerability/CVE-2021-42112",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-42112",
"summary": "The \"File upload question\" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.",
"evidence": "osv:CVE-2021-42112",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-42112",
"aliases": [
"BIT-limesurvey-2021-42112",
"CVE-2021-42112",
"GHSA-h9ph-jcgh-gf69"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/limesurvey/limesurvey",
"type": "GIT",
"events": [
{
"introduced": "2ef1525baed6eb977b5aa50ed02b26bb072a483c"
},
{
"last_affected": "d6c4ac678c32c458e4b8643465afa9fa27e99732"
},
{
"fixed": "d56619a50cfd191bbffd0adb660638a5e438070d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.27.18"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "d56619a50cfd191bbffd0adb660638a5e438070d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.27.18+210921",
"3.27.17+210911",
"3.27.16+210909",
"3.27.15+210907",
"3.27.14+210831",
"3.27.13+210823",
"3.27.12+210816",
"3.27.11+210809",
"3.27.10+210803",
"3.27.9+210726",
"3.27.8+210721",
"3.27.7+210713",
"3.27.6+210629",
"3.27.5+210624",
"3.27.4+210622",
"3.27.3+210615",
"3.27.2+210608",
"3.27.1+210531",
"3.27.0+210525",
"3.26.5+210519",
"3.26.4+210517",
"3.26.3+210511",
"3.26.2+210503",
"3.26.1+210427",
"3.26.0+210419",
"3.25.22+210413",
"3.25.21+210407",
"3.25.20+210330",
"3.25.19+210323",
"3.25.18+210316",
"3.25.17+210309",
"3.25.16+210302",
"3.25.15+210223",
"3.25.14+210218",
"3.25.13+210216",
"3.25.12+210211",
"3.25.11+210210",
"2.2.5",
"3.25.10+210128",
"3.25.9+210125",
"3.25.8+210118",
"3.25.7+210113",
"3.25.6+201229",
"3.25.5+201222",
"3.25.4+201215",
"3.25.3+201208",
"3.25.2+201131",
"3.25.1+201124",
"3.25.0+201117",
"3.24.6+201109",
"3.24.5+201104",
"3.24.4+201103",
"3.24.3+201027",
"3.24.2+201020",
"3.24.1+201014",
"3.24.0+201013",
"3.23.7+201006",
"3.23.6+200929",
"3.23.5+200923",
"3.23.4+200922",
"3.23.3+200909",
"3.23.2+200908",
"3.23.1+200825",
"3.23.0+200813",
"3.22.210+200804",
"3.22.29+200731",
"3.22.28+200728",
"3.22.27+200720",
"3.22.26+200714",
"3.22.25+200706",
"3.22.24+200630",
"3.22.23+200626",
"3.22.22+200625",
"3.22.21+200622",
"3.22.20+200617",
"3.22.19+200605",
"3.22.18+200603",
"3.22.17+200525",
"3.22.16+200519",
"3.22.15+200505",
"3.22.14+200423",
"3.22.13+200415",
"3.22.12+200406",
"3.22.11+200330",
"3.22.10+200323",
"3.22.9+200317",
"3.22.8+200309",
"3.22.6+200219",
"3.22.5+200218",
"3.22.4+200212",
"3.22.3+200211",
"3.22.2+200204",
"3.22.1+200129",
"3.22.0+200127",
"3.21.6+200121",
"3.21.5+200115",
"3.21.4+200108",
"3.21.3+191219",
"3.21.2+191216",
"3.21.1+191210",
"3.21.0+191203",
"3.20.2+191119",
"3.20.1+191114",
"3.20.0+191112",
"3.19.3+191023",
"3.19.2+191017",
"3.19.1+191009",
"3.19.0+191008",
"3.17.16+190906",
"3.17.15+190903",
"3.17.14+190902",
"3.17.13+190824",
"3.17.12+190823",
"3.17.11+190822",
"3.17.10+190821",
"3.17.7+190627",
"3.17.5+190604",
"3.17.4+190529",
"3.17.3+190429",
"3.17.1+190408",
"3.17.0+190402",
"3.16.1+190314",
"3.16.1+190225",
"3.15.9+190214",
"3.15.8+190130",
"3.15.7+190124",
"3.15.6+190108",
"3.15.5+181115",
"3.15.4+181109",
"3.15.3+181108",
"3.15.2+181107",
"3.15.1+181017",
"3.15.0+181008",
"3.14.11+180926",
"3.14.10+180926",
"3.14.10+180924",
"3.14.9+180917",
"3.14.8+180829",
"3.14.7+180827",
"3.14.6+180821",
"3.14.5+180815",
"3.14.4+180810",
"3.14.2+180807",
"3.14.1+180731",
"3.14.0+180730",
"3.13.2+180709",
"3.13.1+180629",
"3.13.0+180628",
"3.12.3+180627",
"3.12.2+180625",
"3.12.1+180616",
"3.12.0+180615",
"3.11.0+180612",
"3.10.0+180611",
"3.9.0+180604",
"3.8.2+180529",
"3.8.1+180524",
"3.8.0+180522",
"3.7.3+180516",
"3.7.2+180508",
"3.7.1+180424",
"3.7.0+180418",
"3.6.3+180416",
"3.6.2+180406",
"3.6.1+180329",
"3.6.0+180328",
"3.5.4+180320",
"3.5.3+180316",
"3.5.2+180315",
"3.5.1+180312",
"3.5.0+180309",
"3.4.4+180305",
"3.4.3+180227",
"3.4.2+180223",
"3.4.1+180221",
"3.4.0+180219",
"3.3.1",
"3.3.0+180209",
"3.2.1+180207",
"3.2.0+180206",
"3.1.1+180130",
"3.1.0",
"3.0.5+180118",
"3.0.4+180116",
"3.0.3+180112",
"3.0.2+180110",
"3.0.0+171222"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-42112.json"
}
}
],
"modified": "2026-10-20T10:54:59.927732784Z",
"provider": "osv",
"references": [
"https://bugs.limesurvey.org/view.php?id=17562",
"https://github.com/LimeSurvey/LimeSurvey/commit/d56619a50cfd191bbffd0adb660638a5e438070d",
"https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-42112",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 386651,
"published_at": "2021-10-08T21:15:07.883+00:00"
}