Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tbx2-t67v-s7d4
Vulnerability ID VCID-tbx2-t67v-s7d4
Aliases CVE-2023-30613
GHSA-fwcf-753v-fgcj
Summary Unrestricted file upload in kiwi TCMS Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. In earlier versions there is no control over what kinds of files can be uploaded. Thus a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files causing vulnerable browsers to execute malicious code on another computer or attempting XSS attacks. Stored XSS attacks via file uploads have been fixed in earlier versions of Kiwi TCMS, see [GHSA-2wcr-87wf-cf9j](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j). This advisory deals with prohibiting users to upload potentially compromised files in the first place.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00694 https://api.first.org/data/v1/epss?cve=CVE-2023-30613
epss 0.00694 https://api.first.org/data/v1/epss?cve=CVE-2023-30613
epss 0.00694 https://api.first.org/data/v1/epss?cve=CVE-2023-30613
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-fwcf-753v-fgcj
cvssv3.1 7.7 https://github.com/kiwitcms/Kiwi
generic_textual HIGH https://github.com/kiwitcms/Kiwi
cvssv3.1 7.7 https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
cvssv3.1 8.1 https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
cvssv3.1_qr HIGH https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
generic_textual HIGH https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
ssvc Track* https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
cvssv3.1 7.7 https://huntr.com/bounties/c30d3503-600d-4d00-9571-98826a51f12c
generic_textual HIGH https://huntr.com/bounties/c30d3503-600d-4d00-9571-98826a51f12c
cvssv3.1 7.7 https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
cvssv3.1 8.1 https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
generic_textual HIGH https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
ssvc Track* https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
cvssv3.1 7.7 https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122
generic_textual HIGH https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122
cvssv3.1 8.1 https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
ssvc Track* https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
cvssv3.1 7.7 https://nvd.nist.gov/vuln/detail/CVE-2023-30613
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-30613
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-30613
https://github.com/kiwitcms/Kiwi
https://huntr.com/bounties/c30d3503-600d-4d00-9571-98826a51f12c
https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122
CVE-2023-30613 https://nvd.nist.gov/vuln/detail/CVE-2023-30613
GHSA-fwcf-753v-fgcj https://github.com/advisories/GHSA-fwcf-753v-fgcj
GHSA-fwcf-753v-fgcj https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/kiwitcms/Kiwi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-04T18:44:55Z/ Found at https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://huntr.com/bounties/c30d3503-600d-4d00-9571-98826a51f12c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-04T18:44:55Z/ Found at https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-04T18:44:55Z/ Found at https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-30613
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.72312
EPSS Score 0.00694
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:44:39.121013+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/kiwitcms/CVE-2023-30613.yml 38.6.0