Vulnerability PYSEC-2026-1499
High Risk
HIGH RISK
CVSS Score: 8.1
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
July 07, 2026 at 11:45 AM UTC
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4
Summary
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Details
Impact
Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly!
The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the Content-Type: text/plain header on some occasions thus allowing potentially dangerous scripts to be executed.
Additionally file upload validators and parts of the HTML rendering code have been found to require additional sanitation and improvements.
Patches
- Updated Nginx content type configuration
- Improved file upload validation code to prevent more potentially dangerous uploads
- Sanitization of test plan names used in the
tree_view_html()function
References
Disclosed by M Nadeem Qazi and Mahshooq Zubair.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 hours ago
Kiwi TCMS account confirmation open redirect through protocol-relative URLs
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 GHSA-gcwf-c25f-p9rv
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 GHSA-gcwf-c25f-p9rv
Low Risk
3 months ago
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 PYSEC-2026-2551
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 PYSEC-2026-2551
Medium Risk
3 months ago
Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 PYSEC-2026-2552
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 PYSEC-2026-2552
Unknown
3 months ago
Kiwi TCMS's /init-db/ page renders and responds to requests after first use
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 PYSEC-2026-2553
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 and 12.4 PYSEC-2026-2553
High Risk
4 months ago
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 PYSEC-2026-1495
6.2.1 and 6.3 and 6.4 and 6.5 and 6.5.3 and 6.6 and 6.7 and 6.8 and 6.9 and 6.10 and 6.11 and 7.0 and 7.1 and 7.2 and 7.2.1 and 7.3 and 8.0 and 8.1 and 8.1.99 and 8.2 and 8.3 and 8.4 and 8.5 and 8.6 and 8.6.1 and 8.7 and 8.8 and 8.9 and 9.0 and 9.999 and 10.0 and 10.1 and 10.2 and 10.3 and 10.3.999 and 10.4 and 10.5 and 11.0 and 11.1 and 11.3 and 11.4 and 11.5 and 11.6 and 11.7 and 12.0 and 12.1 and 12.2 and 12.3 PYSEC-2026-1495
Impacted packages
Timeline
Published
4 months ago
July 07, 2026 at 11:45 AM UTC
Last Modified
4 months ago
July 07, 2026 at 05:47 PM UTC