Please report (suspected) security vulnerabilities by creating a bug report on https://bugs.limesurvey.org and mark it as private. Marking it as private will make the bug report visible to only users who have access. Another option would be to send the information to support@limesurvey.org, directly.
You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.