N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55630

CVE-2026-55630: Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary

In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55630

CVE-2026-55630:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kiwitcms	pip	<= 12.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Kiwi TCMS. The root cause is the lack of input validation on the extra_link fields of the TestCase and TestPlan models. These fields were defined as CharField, which does not enforce any specific format, allowing users to input malicious javascript: URIs.

The patch, identified in commit d5d36e74cf9333cb37e3a8743b22b74dfa9a0139, addresses this by changing the field type from CharField to URLField and adding a URLValidator. This validator restricts the allowed URL schemes to http, https, ftp, and ftps, effectively preventing the injection of javascript: URIs.

During exploitation, a user would save a TestCase or TestPlan with a malicious extra_link. The application would then store this link in the database. When another user views the TestCase or TestPlan, the malicious link would be rendered in the browser, executing the embedded JavaScript. Therefore, the save methods of the TestCase and TestPlan models are the key functions that would appear in a runtime profile during the storage phase of the attack.

Vulnerable functions

tcms.testcases.models.TestCase.save

tcms/testcases/models.py

The `extra_link` field in the `TestCase` model was a `CharField` without any validation. This allowed malicious input, such as `javascript:` URIs, to be saved to the database. When this field is rendered in a template, it can lead to a stored Cross-Site Scripting (XSS) vulnerability. The `save` method of the model is responsible for persisting this malicious data.

tcms.testplans.models.TestPlan.save

tcms/testplans/models.py

The `extra_link` field in the `TestPlan` model was a `CharField` without any validation. This allowed malicious input, such as `javascript:` URIs, to be saved to the database. When this field is rendered in a template, it can lead to a stored Cross-Site Scripting (XSS) vulnerability. The `save` method of the model is responsible for persisting this malicious data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.