{"cve":"CVE-2023-36809","nvd":{"published":"2023-07-05T22:15:09.670","modified":"2026-06-17T06:07:07.320","status":"Modified","description":"Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the `tree_view_html()` function.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79","CWE-434"],"references":["https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-jpgw-2r9m-8qfw","https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8/","https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223/","https://kiwitcms.org/blog/kiwi-tcms-team/2023/07/04/kiwi-tcms-125/","https://www.github.com/kiwitcms/kiwi/commit/195ea53eaaf360c19227c864cc0fe58910032c3c"],"products":["kiwitcms:kiwi_tcms"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-36809","score":0.00692,"percentile":0.52908,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-jpgw-2r9m-8qfw","url":"https://osv.dev/vulnerability/GHSA-jpgw-2r9m-8qfw","summary":"Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox","modified":"2026-07-07T17:56:37.771952404Z","packages":[{"ecosystem":"PyPI","name":"kiwitcms","purl":"pkg:pypi/kiwitcms","ranges":["<12.5"],"fixed":["12.5"]}]},{"id":"PYSEC-2026-1499","url":"https://osv.dev/vulnerability/PYSEC-2026-1499","summary":"Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox","modified":"2026-07-07T17:47:14.102469133Z","packages":[{"ecosystem":"PyPI","name":"kiwitcms","purl":"pkg:pypi/kiwitcms","ranges":["<12.5"],"fixed":["12.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}