SHIRASAGI CMS: XSS & Information Disclosure Fix (CVE-2026-81635/82582)

JVN#37476837 SHIRASAGI Vulnerability Summary Vulnerability Overview Vulnerability Type: Cross-Site Scripting (XSS) CVE Number: CVE-2026-81635 Announcement Date: September 10, 2026 Publishing Bodies: Jointly issued by JPCERT/CC and IPA Description: An XSS vulnerability exists in SHIRASAGI, allowing an attacker to execute malicious scripts by leveraging this flaw. Scope of Impact Affected Versions: Versions prior to v1.21.0 (specifically from v1.14.0 to v1.20.2) Fixed Version: Fixed in v1.21.0 Trigger Conditions: 1. The attacker logs in to the CMS management panel and accesses the target folder. 2. The URL of the target folder's link contains the following content: 3. When a user with access to the target folder visits this URL, the malicious script is executed. Remediation Upgrade Recommendation: Upgrade SHIRASAGI to v1.21.0 or later. Related Commits: - https://github.com/shirasagi/shirasagi/commit/898768c1b6c187ee780804e07a36197e265b667 - https://github.com/shirasagi/shirasagi/commit/5c9907c158402073a10a8b35a6c42987 - https://github.com/shirasagi/shirasagi/commit/90c9e66c28c222320428091a890b42a6f Handleable Vulnerability (CVE-2026-82582) Vulnerability Type: Handleable vulnerability (an exploitable flaw where file paths in shared files can be manipulated) Trigger Conditions: An attacker can retrieve file contents by specifying file paths within shared files. Affected Versions: Versions prior to v1.20.2 Fixed Version: Fixed in v1.21.0 Related Commits: - https://github.com/shirasagi/shirasagi/commit/5c9907c158402073a10a8b35a6c42987 - https://github.com/shirasagi/shirasagi/commit/90c9e66c28c222320428091a890b42a6f Version Upgrade Notes Upgrade Advice: When upgrading from versions prior to v1.14.2, pay attention to the upgrade instructions for v1.15.0, as there are significant changes to the CMS.

Goal Reached Thanks to every supporter — we hit 100%!

SHIRASAGI CMS: XSS & Information Disclosure Fix (CVE-2026-81635/82582)