PT-2026-56086

CVE-2026-55630

Published

2026-07-06

Updated

2026-09-17

Description by

CVSS 3.1

0.0

Not available

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 16.1

Description User input in the TestCase.extra link and TestPlan.extra link fields is not sanitized and is rendered verbatim, allowing for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Deployments using official Docker images or unmodified middleware utilize a Content-Security-Policy header that blocks inline JavaScript execution, mitigating the risk. However, customized deployments with modified security settings remain susceptible.

Recommendations Update to version 16.1.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-55630

GHSA-473P-56XX-VG67