CVE-2023-30613 json
Kiwi TCMS unrestricted file upload vulnerability
published 2023-04-24 3 y ago modified 2026-07-07 4 mo ago also GHSA-fwcf-753v-fgcj , PYSEC-2026-1498 , EUVD-2023-1299
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files, causing vulnerable browsers to execute malicious code on another computer.
Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `<script>` tag, regardless of their type are also denied b/c they are a path to XSS attacks. There are no known workarounds aside from upgrading.
Patch / fix
- pypi kiwitcms 12.2
- kiwitcms kiwi_tcms 12.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/c30d3503-600d-4d00-9571-98826a51f12c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | kiwitcms | <12.2 |
12.2 |
Affected products
- kiwitcms Kiwi
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
huntr.com
/bounties/c30d3503-600d-4d00-9571-98826a51f12c
exploit, web, third-party-advisory
-
github.com
/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
web, vendor-advisory
-
huntr.dev
/bounties/c30d3503-600d-4d00-9571-98826a51f12c
web, permissions-required
-
kiwitcms.org
/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-30613
advisory
-
github.com
/kiwitcms/Kiwi
package
-
kiwitcms.org
/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122
web
-
pypi.org
/project/kiwitcms
package
-
github.com
/advisories/GHSA-fwcf-753v-fgcj
advisory
Sources
- CVE List CVE-2023-30613
- GitHub Advisory GHSA-fwcf-753v-fgcj
- NVD CVE-2023-30613
- OSV PYSEC-2026-1498
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.