After further observation, we didn't found a way to execute code on the server via a forged uploaded file, so I believe this issue severity might be lower than expected.

Hello there our company is trying to adopt Limesurvey so we ran a security audit before adoption and they discovered three security issues blocking adoption.

Two of them are related to Upload Question Plugin. One of this two is related on missing content type validation. They mean if we expect a jpeg file also content type must be validated, not only file extension.

The security issue here isn't related to executable php code but to malicious binary files disguised

I'd like to inspect code but I'm not really aware about it, do it reside inside UploaderController.php?
https://github.com/LimeSurvey/LimeSurvey/blob/master/application/controllers/UploaderController.php

Right : we check extension, not mimetype
https://github.com/LimeSurvey/LimeSurvey/blob/d16e00518dbf62777e08cd2340b1dd2da4ae4921/application/controllers/UploaderController.php#L142

Still an issue

PS : maybe we can (in PHP)

1. use mime_content_type to get all mimeType allowed
2. Use CFileHelper::getMimeType to compare mimeType

Move category : security to Survey taking. All client action are not a security fix for server.

Ops … sorry … the original issue is about real security …

https://github.com/LimeSurvey/LimeSurvey/commit/d3eb007e64e9f17d69604440a7890f9f0b628b16

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=28983

Thank you for your effort! : )

If you want to update «manually» there are some other fix after this one …

You can get the new controller here : https://github.com/LimeSurvey/LimeSurvey/blob/5ff4910ea13e97a057bd6ab784b1ab1902ffe622/application/controllers/UploaderController.php

I think it can work for all 3.X version (not tested) (3.17.X sure at 100%)

Thank you