CVE-2026-55630

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 16.1

Description User input in the TestCase.extra link and TestPlan.extra link fields is not sanitized and is rendered verbatim, allowing for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Deployments using official Docker images or unmodified middleware utilize a Content-Security-Policy header that blocks inline JavaScript execution, mitigating the risk. However, customized deployments with modified security settings remain susceptible.

Recommendations Update to version 16.1.