PT-2026-56086 · Pypi · Kiwi Tcms

Publicado 2026-07-06 · Atualizado 2026-07-06 · CVE-2026-55630

OSV

CVSS v3.1

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Summary

In Kiwi TCMS the fields TestCase.extra link and TestPlan.extra link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-55630

GHSA-473P-56XX-VG67

Produtos afetados

Kiwi Tcms

Referências · 5

• https://github.com/kiwitcms/Kiwi/releases/tag/v16.1 · Nota
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67 · Nota
• https://github.com/kiwitcms/Kiwi · Nota
• https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161 · Nota
• https://osv.dev/vulnerability/GHSA-473p-56xx-vg67 · Aviso do Fabricante