kiwitcms vulnerable to stored XSS via unrestricted files upload (CVE-2023-32686) | HOL Guard CVE

Medium · CVSS 5.4CVE-2023-32686GHSA-X7C2-7WVG-JPX7

kiwitcms vulnerable to stored XSS via unrestricted files upload

Answer in brief

CVE-2023-32686 records a Medium severity (CVSS 5.4) vulnerability in kiwitcms vulnerable to stored XSS via unrestricted files upload. The current sources do not mark it as known exploited. The current feed maps kiwitcms (pypi). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published May 22, 2023Updated Sep 10, 2026Source checked Sep 10, 2026First seen by HOL Sep 10, 2026Material review Sep 10, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.4
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 5.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps kiwitcms (pypi). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
kiwitcmspypi	>=0 <12.3	12.3

Recommended response

Check inventory. Check lockfiles and deployed manifests for kiwitcms.
Review the reported fix. Update kiwitcms to 12.3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
May 22, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded, see [GHSA-fwcf-753v-fgcj](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj) and Content-Security-Policy definition to prevent cross-site-scripting attacks, see [GHSA-2wcr-87wf-cf9j](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j). The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploting this flaw a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. ### Patches - File upload validation code has been improved - Kiwi TCMS will now force `Content-Type: text/plain` when serving uploaded files ### Workarounds 1) Force the Content-Type header via a custom Django middleware, see `ExtraHeadersMiddleware` in https://github.com/kiwitcms/Kiwi/blob/master/tcms/core/middleware.py#L23 and/or 2) Force the Content-Type header via Nginx overrides, see `location /uploads/` in https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf ### References Disclosed by [Antonio Spataro](https://huntr.dev/bounties/db75275f-8bcd-482b-ae12-feff660d4794) and [ek1ng](https://huntr.dev/bounties/46d5b535-bdff-4b98-8691-a907591fcf10/). Additional credits to [Ahmed Rabeaa Mosa](https://huntr.dev/bounties/cbc2676a-90ff-457f-9cdc-2a7981f960f3/).

Quoted source text, attributed separately from HOL analysis.