Is CVE-2023-33977 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-33977 being exploited in the wild.

How severe is CVE-2023-33977?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

Kiwi TCMS <=12.3; fixed in 12.4; kiwitcms (PyPI) ECOSYSTEM:introduced=0,fixed=12.4.

Is there a fix for CVE-2023-33977?

Yes. kiwitcms (PyPI): upgrade to 12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-33977 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2023-33977?

Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-33977: PYSEC-2026-1495 - kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

Q: Which products and versions are affected?

Kiwi TCMS <=12.3; fixed in 12.4; kiwitcms (PyPI) ECOSYSTEM:introduced=0,fixed=12.4.

Q: Is there a fix for CVE-2023-33977?

Yes. kiwitcms (PyPI): upgrade to 12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-33977 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2023-33977?

Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-33977 · Severity: low · CVSS 3.1 · Published 2026-07-07

Kiwi TCMS is a web-based test case management system that allows users to upload attachments to test plans and cases. Due to insufficient file upload validation and improper HTTP header handling in reverse proxy configurations, attackers can upload malicious files containing JavaScript code that executes in users' browsers when the files are accessed, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

Technologies: Kiwi TCMS, kiwitcms (PyPI). Vendors: Kiwi TCMS, PyPI.

Quick answers

Is CVE-2023-33977 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-33977 being exploited in the wild.
How severe is CVE-2023-33977?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: Kiwi TCMS <=12.3; fixed in 12.4; kiwitcms (PyPI) ECOSYSTEM:introduced=0,fixed=12.4.
Is there a fix for CVE-2023-33977?: Yes. kiwitcms (PyPI): upgrade to 12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-33977 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2023-33977?: Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kiwitcms (PyPI): upgrade to 12.4 or later
```
pip install "kiwitcms>=12.4"
```

Technical details

This vulnerability combines unrestricted file upload (CWE-434) and stored cross-site scripting (CWE-79). The root cause is twofold: (1) file upload validation checks could be circumvented to upload dangerous files, and (2) Nginx's proxy_pass directive strips HTTP headers that Kiwi TCMS relies on for content-security-policy protections when deployed behind a reverse proxy. An attacker without authentication can upload a malicious file containing JavaScript to test plans or test cases. When other users access the uploaded file through their browsers, the arbitrary JavaScript executes in their context. The vulnerability requires user interaction (clicking the uploaded file link). Patches were released in version 12.4 with improved file upload validation and updated Nginx proxy configuration guidance.

Affected products

Kiwi TCMS Kiwi TCMS <=12.3; fixed in 12.4

Identifiers

CVE-2023-33977
GHSA-2fqm-m4r2-fh98
PYSEC-2026-1495

Timeline

2023-06-06: disclosed
2023-06-06: patched: Version 12.4 released

References

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.