What LimeSurvey/LimeSurvey shipped
Written by FoxPlug from public releases; not affiliated with Limesurvey. An automatic summary of the public release, pull request and commit data of github.com/LimeSurvey/LimeSurvey. Limesurvey did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Fixed security vulnerability in participant sharing that allowed authenticated users to grant themselves elevated permissions. Pull request #5327
- Fixed security vulnerability in central participant database attribute deletion that allowed unauthorized modifications. Pull request #5329
- Fixed reflected XSS vulnerability in survey structure import warnings that could execute attacker-supplied code. Pull request #5330
- Fixed security issue where Expression Manager admin actions lacked permission checks on maintenance operations. Pull request #5328
- Fixed reflected XSS vulnerability in participant CSV import results. Pull request #5331
- Added permission controls for queXML exports, SPSS exports, and survey archive ZIP downloads. Pull request #5325
- Fixed insufficient session invalidation vulnerability where sessions persisted after password changes. Pull request #5326
- Fixed LSActiveRecord::encryptSave() to run validations by default, matching standard save method behavior. Pull request #3596
- Added horizontal scrolling to bar charts containing more than 20 answer options. Pull request #5318
- Fixed admin creation emails to support Expression Manager syntax and plugin replacements. Pull request #5350
Why it matters
This week addresses seven security vulnerabilities across access control, session management, and input validation that could allow unauthorized actions or code execution. Alongside these critical fixes, the maintainers improved chart usability, email template processing, and validation behavior for data integrity.
Changelog entry
- Security: Fixed broken access control in participant sharing (CVSS 7.1) Pull request #5327
- Security: Fixed broken access control in CPDB attribute deletion (CVSS 8.1) Pull request #5329
- Security: Fixed reflected XSS in survey import warnings (CVSS 8.0) Pull request #5330
- Security: Fixed missing permission checks on Expression Manager maintenance actions Pull request #5328
- Security: Fixed reflected XSS in participant CSV import results (CVSS 8.0) Pull request #5331
- Security: Added permission controls for queXML, SPSS exports, and survey archive downloads Pull request #5325
- Security: Fixed session persistence after password change (CVSS 5.4) Pull request #5326
- Fixed: LSActiveRecord::encryptSave() now runs validations by default Pull request #3596
- Added: Horizontal scrolling to bar charts with more than 20 answer options Pull request #5318
- Fixed: Admin creation emails now support Expression Manager and plugin replacements Pull request #5350
- Added: Configurable welcome images for surveys with multiple layout options Pull request #5274
- Added: Image opacity control for survey welcome images Pull request #5336
- Fixed: SurveyDetail API command memory exhaustion on large surveys Pull request #5319
- Dev: PHP 8.5 compatibility fixes and improved CI testing Pull request #5323
7.2.0+260921 released. Security fixes for participant sharing, CPDB deletion, CSV import, XSS in imports, Expression Manager access control, queXML/SPSS exports, and session expiration. Charts now scroll for many options.
LimeSurvey 7.2.0+260921 ships this week with fixes for seven security vulnerabilities affecting participant management, export controls, and input validation. Enhanced features include horizontal scrolling for charts with many options, Expression Manager support in admin emails, and validation improvements in data persistence. Session management now properly invalidates on password change.
Week of September 14, 2026
What shipped
- Responses table now records matched quota IDs when the save quota exit setting is enabled for surveys and survey groups. Pull request #5317
- Survey timing information is now displayed in the response table with configurable timing columns through the column organizer. Pull request #5249
- Welcome screen image uploads are now available for the Fruity TwentyThree survey theme with configurable layout options. Pull request #5298
- Survey welcome screen now supports image uploads with privacy policy preview options for inline and popup formats. Pull request #5280
- Feature announcement modal for editor activation now includes localized image slides with slider navigation and animations. Pull request #5285
- Authentication now supports the X-Auth-Token header for authwebserver requests with IIS. Pull request #5306
- Pie charts now start at 12 o'clock and progress clockwise with clearer labels showing answer titles and metrics. Pull request #5310
- Response statistics charts now display value labels above bars with rounded percentage metrics. Pull request #5286
- Single-choice and multiple-choice answer buttons now use responsive grid formatting with standardized sizing and spacing. Pull request #5259
- HTML language attributes are now corrected to use valid standardized values across survey, print, and error pages. Pull request #5281
Why it matters
This week brings improvements to survey response handling with quota tracking and timing display, enhances the survey experience with welcome screen customization options, and fixes multiple chart presentation issues. Quality-of-life improvements span from accessibility corrections to authentication support and button alignment fixes.
Changelog entry
- Added optional Save quota exit setting to record matched quota IDs with survey responses Pull request #5317
- Fixed authwebserver authentication to support X-Auth-Token header for IIS compatibility Pull request #5306
- Corrected invalid HTML language attributes across survey, print, maintenance, and error pages Pull request #5281
- Improved localization for statistics including selection counts, ranking labels, and vote totals Pull request #5315
- Pie charts now start at 12 o'clock with clockwise progression and clearer label formatting Pull request #5310
- Improved migration handling for ranking questions when subquestions have been deleted Pull request #5311
- Added configurable survey timing information display in response table Pull request #5249
- Standardized pagination controls across administrative lists and data grids with preserved page-size selections Pull request #5246
- Improved responsive grid formatting and alignment for single-choice and multiple-choice answer buttons Pull request #5259
- Restored global theme options on survey error pages with consistent logo display and sizing Pull request #5309
- Updated build tooling including Sass, Rollup, Jest, Storybook, and Gulp packages Pull request #5251
- Added configurable welcome-image layouts for Fruity TwentyThree theme with left, right, and centered options Pull request #5298
- Added welcome screen privacy policy previews and improved image handling across survey elements Pull request #5280
- Improved default chart selection based on question type with array-text questions remaining in table view Pull request #5277
- Fixed tableExists helper function to clear schema cache for accurate database state detection Pull request #4771
- Added
allowed_classesrestriction to unserialize() calls to prevent PHP Object Injection attacks Pull request #5016 - Fixed pie chart label positioning with improved layout consistency and vertical adjustment Pull request #5288
- Fixed blank page display when changing survey in preview by handling missing survey group details Pull request #5294
- Added value labels above bars in response statistics charts with rounded percentage display Pull request #5286
- Added localized image slides with slider navigation and animations to editor feature announcement modal Pull request #5285
LimeSurvey 7.1.1 is out. Quota exit tracking in responses, survey timings visible in tables, improved pie charts, and welcome screen image uploads are ready to use.
LimeSurvey releases 7.1.1 with several quality improvements: quota exit IDs now recorded in responses, survey timing data displayed in response tables, configurable welcome screen images for themes, corrected pie chart display with values on bars, and better alignment for choice buttons. Authentication header support for IIS and HTML language attribute fixes improve compatibility and accessibility across the platform.