CVE-2026-55630: Kiwi TCMS Stored XSS Vulnerability

CVE-2026-55630 Overview

CVE-2026-55630 is a stored cross-site scripting (XSS) vulnerability in Kiwi TCMS, an open source test management system. Versions prior to 16.1 accept unsanitized user input in the TestCase.extra_link and TestPlan.extra_link fields and render stored values verbatim. An authenticated attacker can persist malicious payloads that execute in other users' browsers when they view affected records. Official Docker images and unmodified Kiwi TCMS middleware ship a Content-Security-Policy (CSP) header that blocks inline JavaScript, which limits exploitation in default deployments. Customized deployments that weaken CSP or middleware defaults remain exposed. The issue is fixed in version 16.1, which sanitizes both fields and nullifies existing database records that fail validation.

Critical Impact
Stored XSS payloads in extra_link fields can execute in the sessions of authenticated Kiwi TCMS users when default CSP protections have been weakened, enabling session theft, action forgery, or credential harvesting.

Affected Products

Kiwi TCMS versions prior to 16.1
Customized Kiwi TCMS deployments with weakened Content-Security-Policy headers
Deployments not using official Docker images or unmodified middleware

Discovery Timeline

2026-09-15 - CVE-2026-55630 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-55630

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. Kiwi TCMS exposes two model fields, TestCase.extra_link and TestPlan.extra_link, that allow users to attach reference URLs or annotations to test artifacts. Prior to version 16.1, the application persisted the values submitted to these fields without sanitizing HTML or JavaScript content. When any authenticated user viewed the affected TestCase or TestPlan, the stored value was rendered verbatim in the response body.

This creates a persistent injection primitive. An attacker with permission to create or edit test artifacts can inject markup that executes in the browser context of every subsequent viewer. Because test management systems are typically shared across QA, development, and release teams, a single poisoned record can reach many high-privilege accounts.

Exploitation impact depends on deployment configuration. Official Docker images send a restrictive CSP that blocks inline JavaScript execution, blunting most payloads. Deployments that remove or relax the CSP header, or that host Kiwi TCMS behind reverse proxies that strip security headers, lose that mitigation.

Root Cause

The root cause is missing input sanitization and output encoding on the extra_link fields. The affected code paths did not enforce URL validation or HTML escaping before storing or rendering user-supplied values. Version 16.1 introduces field-level validation and rewrites non-conforming existing records to null.

Attack Vector

An authenticated attacker submits a crafted payload to TestCase.extra_link or TestPlan.extra_link through the standard editing interfaces or API. The payload is stored in the database and rendered in every subsequent page view of the affected artifact. Exploitation requires user interaction, as a victim must load the poisoned record. Successful execution depends on the absence or weakening of the shipped CSP header.

See the GitHub Security Advisory GHSA-473p-56xx-vg67 and the fix commits 1c2ecc8 and d5d36e7 for technical details.

Detection Methods for CVE-2026-55630

Indicators of Compromise

Values in TestCase.extra_link or TestPlan.extra_link containing <script>, javascript:, on*= event handlers, or encoded variants such as <script>.
Database records where extra_link contains HTML tags, angle brackets, or non-URL content.
Web server access logs showing outbound requests from user sessions to unfamiliar domains immediately after loading TestCase or TestPlan pages.

Detection Strategies

Query the Kiwi TCMS database directly for extra_link values that do not match a strict URL pattern.
Inspect HTTP responses for TestCase and TestPlan detail pages and confirm that rendered extra_link output is properly escaped.
Review deployment configuration to confirm the shipped Content-Security-Policy header is present and not overridden by upstream proxies.

Monitoring Recommendations

Enable web server and application logging for edit operations against TestCase and TestPlan objects and review for anomalous field content.
Alert on CSP violation reports if a reporting endpoint is configured, as blocked inline script attempts indicate exploitation attempts.
Monitor authentication logs for unexpected session activity from accounts that recently viewed modified test artifacts.

How to Mitigate CVE-2026-55630

Immediate Actions Required

Upgrade Kiwi TCMS to version 16.1 or later, which sanitizes extra_link fields and resets non-conforming existing records to null.
Audit existing TestCase.extra_link and TestPlan.extra_link values for injected markup before or immediately after upgrading.
Verify that the deployment still emits the default Content-Security-Policy header and has not been weakened by middleware changes or reverse proxy configuration.

Patch Information

The fix is included in Kiwi TCMS v16.1. The remediation was implemented in commits 1c2ecc8 and d5d36e7, which add validation for the extra_link fields and rewrite invalid stored values to null on upgrade.

Workarounds

Retain the default Content-Security-Policy header shipped with official Docker images and unmodified middleware to block inline JavaScript execution.
Restrict edit permissions on TestCase and TestPlan objects to trusted users until the upgrade is applied.
Manually null or sanitize existing extra_link values in the database that contain non-URL content.

bash

# Configuration example: verify CSP header on a Kiwi TCMS deployment
curl -sI https://kiwi.example.com/ | grep -i 'content-security-policy'