Security readout for executives and security teams
Plain-English summary
CVE-2018-1000658 affects LimeSurvey versions before 3.14.4. An authenticated user could upload a crafted zip archive containing PHP files and, under certain conditions, cause server-side code execution through a webshell. The source bundle does not provide CVSS, CWE, or active exploitation evidence.
Executive priority
Treat as a priority remediation for any exposed or business-critical LimeSurvey deployment. Authenticated code execution can lead to server compromise, data exposure, and persistence, but urgency should be calibrated because the provided sources do not show known active exploitation.
Technical view
The vulnerability is in LimeSurvey upload functionality before version 3.14.4. The reported path involves an authenticated user uploading a zip archive that can contain malicious PHP files, which may later be callable under certain circumstances. The CVE states the issue was fixed after commit 91d143230eb357260a19c8424b3005deb49a47f7 and version 3.14.4.
Likely exposure
Exposure is most likely where LimeSurvey is older than 3.14.4 and authenticated users can access the affected zip upload workflow. Risk depends on account control, upload permissions, and whether uploaded PHP can become reachable or executable on the server.
Exploitation context
The bundle does not show CISA KEV listing or other active exploitation evidence. The CVE text says exploitation appears possible through authenticated upload of a zip archive containing malicious PHP files that can be called under certain circumstances.
Researcher notes
The CVE metadata is sparse: no CVSS vector, CWE, detailed affected CPEs, or exploit evidence are provided. The strongest technical evidence is the CVE description and the referenced LimeSurvey commits. Validate against real deployment versioning and upload permissions before scoping impact.
Mitigation direction
- Upgrade LimeSurvey to version 3.14.4 or later.
- Apply the vendor fix commits if upgrading is not immediately possible.
- Review LimeSurvey vendor guidance for supported remediation details.
- Restrict upload-capable accounts to trusted users until remediation is complete.
- Review web server handling of uploaded PHP content.
Validation and detection
- Inventory LimeSurvey deployments and record their versions.
- Confirm all production instances run LimeSurvey 3.14.4 or later.
- Review who can authenticate and use zip upload functionality.
- Check upload directories for unexpected PHP files or webshell indicators.
- Verify the relevant fix commits are present in custom builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-1000658 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/LimeSurvey/LimeSurvey/commit/91d143230eb357260a19c8424b3005deb49a47f7CVE reference · x_refsource_CONFIRM
- https://github.com/LimeSurvey/LimeSurvey/commit/20fc85edccc80e7e7f162613542792380c44446aCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.