View Issue Details

Jump to NotesJump to History
This bug affects 1 person(s).
 250
IDProjectCategoryView StatusDate SubmittedLast Update
20126Bug reportsSecuritypublic2025-05-27 07:342025-05-27 07:34
Reportermanfredsteger Assigned To 
PrioritynoneSeveritypartial_block 
Status newResolutionopen 
Product Version6.6.x 
Summary20126: End-of-Life Software Components in LimeSurvey 6.10.x
Description

A recent analysis revealed that LimeSurvey 6.10.x makes use of software components that are either officially End-of-Life (EOL) or no longer maintained. This status implies that these packages no longer receive security updates or patches, making them a liability in production environments.

Name Version Latest Version Reason Location
ckeditor4 4.22.1 4.25.1 https://endoflife.date/ckeditor /tmp/assets/a26664b9/ckeditor.js
kcfinder 3.12 3.12 The GitHub repository has been archived; the last update was over 10 years ago. https://github.com/sunhater/kcfinder

� Recommended Actions

ckeditor4

    Upgrade to the latest available 4.x version if possible (4.25.1), or better: migrate to CKEditor 5, which is actively maintained.

    Note: Officially considered EOL according to endoflife.date.

kcfinder

    The project has been abandoned; consider replacing it with a maintained alternative (e.g., elFinder).

    Retain only in legacy environments if absolutely necessary — not recommended for production use.

Review the entire dependency tree of LimeSurvey and set up automated monitoring for EOL and vulnerable packages.
Steps To Reproduce

OWASP Test or with pentest-tools.com

TagsNo tags attached.
Attached Files
eols.png (247,904 bytes)
Bug heat250
Complete LimeSurvey version number (& build) 6.10.5
I will donate to the project if issue is resolvedYes
BrowserFF 138.0.4 (aarch64)
Database type & versionMaria DB 11.4
Server OS (if known)Ubuntu 22
Webserver software & version (if known)Apache/2.4.62 (Debian)
PHP Version8.3.17

Users monitoring this issue

There are no users monitoring this issue.

Activities

Issue History

Date Modified Username Field Change
2025-05-27 07:34 manfredsteger New Issue
2025-05-27 07:34 manfredsteger File Added: eols.png