Kiwi TCMS CVE-2026-55630

LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-06 https://github.com/kiwitcms/Kiwi

GHSA-473p-56xx-vg67

XSS Docker

Severity by source

vuln.today AI

5.4 MEDIUM

Stored XSS requires authenticated write access (PR:L), victim page view (UI:R), scope change to victim browser (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 22:43 vuln.today

DescriptionCVE.org

Summary

In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

AnalysisAI

Stored cross-site scripting in Kiwi TCMS versions prior to 16.1 allows authenticated users to inject arbitrary JavaScript into the TestCase.extra_link and TestPlan.extra_link fields, which are rendered verbatim to all subsequent viewers. Official Docker-based deployments are substantially protected by a Content-Security-Policy header that blocks inline script execution, but customized deployments that alter default middleware or security settings remain fully exploitable. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Authenticate to Kiwi TCMS

Delivery

Submit XSS payload in extra_link field

Exploit

Payload stored in database

Install

Victim opens affected TestCase or TestPlan

Browser renders unsanitized field

Execute

Injected script executes in victim session

Impact

Steal session token or perform actions as victim

Recon

Authenticate to Kiwi TCMS

Delivery

Submit XSS payload in extra_link field

Exploit

Payload stored in database

Install

Victim opens affected TestCase or TestPlan

Browser renders unsanitized field

Execute

Injected script executes in victim session

Impact

Steal session token or perform actions as victim

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to hold a valid Kiwi TCMS account with write access to TestCase or TestPlan objects in order to store the malicious payload - unauthenticated exploitation is not possible via this vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS base vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N) is anomalous and appears to be a placeholder - a score of C:N/I:N/A:N is inconsistent with stored XSS, which inherently carries confidentiality and integrity impact through session hijacking and DOM manipulation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Kiwi TCMS user with permission to create or edit test cases submits a JavaScript payload (e.g., a cookie-stealing script) in the `extra_link` field of a TestCase. When a project manager or another team member opens that test case in their browser, the unsanitized value is rendered and the script executes in the victim's session, potentially exfiltrating session tokens to an attacker-controlled server. …
Remediation	Upgrade to Kiwi TCMS 16.1, available at https://github.com/kiwitcms/Kiwi/releases/tag/v16.1. … Detailed patch versions, workarounds, and compensating controls in full report.