CVE-2026-55630— Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Quick assessment
Affected
kiwitcms Kiwi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kiwi TCMS 是一个开源的测试管理系统。在 16.1 版本之前，TestCase.extra_link 和 TestPlan.extra_link 字段接收未经清理的用户输入，并将存储的值原样渲染，从而产生跨站脚本（XSS）攻击的风险。官方 Docker 镜像和未经修改的 Kiwi TCMS 中间件会发送 Content-Security-Policy（CSP）响应头，该策略会阻止内联 JavaScript 的执行，因此在默认部署下利用该漏洞较为困难；而经过定制、削弱了相关安全设置的部署仍可能保持易受攻击状态
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55630
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Source: CVE Program / CVE List V5
Vulnerability Description
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-55630
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55630
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55630 (2)
Vendor Advisories for CVE-2026-55630 (1)
Vendor Pages for CVE-2026-55630 (1)
-
🔗 Release Kiwi TCMS 16.1 (24 Jun 2026) · kiwitcms/Kiwi · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: Kiwi
-
CVE-2026-54724
Kiwi TCMS: Open Redirect via unvalidated next parameter in a -
CVE-2025-58790
WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) -
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS exec -
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file uplo -
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upl
Same vendor: kiwitcms
-
CVE-2026-54724
Kiwi TCMS: Open Redirect via unvalidated next parameter in a -
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS exec -
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file uplo -
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upl -
CVE-2023-30628
Kiwi TCMS has command injection vulnerability in changelog.y
Same weakness: CWE-79
-
CVE-2026-81899
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via gr -
CVE-2026-18113
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the -
CVE-2026-81898
Concrete CMS below version 9.5.3 is vulnerable to Stored XS -
CVE-2026-12749
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-12750
Multiple security vulnerabilities are addressed with IBM Clo
V. Comments for CVE-2026-55630
No comments yet