# CVE-2023-33977: PYSEC-2026-1495 - kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

Source: https://junglewise.ai/threats/cve-2023-33977-kiwi-tcms-stored-cross-site-scripting-via-unrestricted-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-33977 · Severity: low · CVSS 3.1 · Published 2026-07-07

Kiwi TCMS is a web-based test case management system that allows users to upload attachments to test plans and cases. Due to insufficient file upload validation and improper HTTP header handling in reverse proxy configurations, attackers can upload malicious files containing JavaScript code that executes in users' browsers when the files are accessed, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

Technologies: [Kiwi TCMS](https://junglewise.ai/threats/technologies/kiwi-tcms), [kiwitcms (PyPI)](https://junglewise.ai/threats/technologies/kiwitcms). Vendors: [Kiwi TCMS](https://junglewise.ai/threats/vendors/kiwi-tcms), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-33977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-33977 being exploited in the wild.

**How severe is CVE-2023-33977?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** Kiwi TCMS <=12.3; fixed in 12.4; kiwitcms (PyPI) ECOSYSTEM:introduced=0,fixed=12.4.

**Is there a fix for CVE-2023-33977?** Yes. kiwitcms (PyPI): upgrade to 12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-33977 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-33977?** Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kiwitcms (PyPI): upgrade to 12.4 or later

  ```sh
  pip install "kiwitcms>=12.4"
  ```


## Technical details

This vulnerability combines unrestricted file upload (CWE-434) and stored cross-site scripting (CWE-79). The root cause is twofold: (1) file upload validation checks could be circumvented to upload dangerous files, and (2) Nginx's proxy_pass directive strips HTTP headers that Kiwi TCMS relies on for content-security-policy protections when deployed behind a reverse proxy. An attacker without authentication can upload a malicious file containing JavaScript to test plans or test cases. When other users access the uploaded file through their browsers, the arbitrary JavaScript executes in their context. The vulnerability requires user interaction (clicking the uploaded file link). Patches were released in version 12.4 with improved file upload validation and updated Nginx proxy configuration guidance.

## Affected products

- Kiwi TCMS Kiwi TCMS <=12.3; fixed in 12.4

## Identifiers

- CVE-2023-33977
- GHSA-2fqm-m4r2-fh98
- PYSEC-2026-1495

## Timeline

- 2023-06-06: disclosed
- 2023-06-06: patched: Version 12.4 released

## References

- [https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98)

## Related threats

- [Kiwi TCMS account confirmation open redirect via protocol-relative URLs](https://junglewise.ai/threats/cve-2026-77433-kiwi-tcms-account-confirmation-open-redirect-through-protocol)
- [Kiwi TCMS missing authorization in database initialization page](https://junglewise.ai/threats/cve-2026-49292-kiwi-tcms-missing-authorization-in-database-initialization-page)
- [Kiwi TCMS stored XSS in TestPlan and TestCase extra_link fields](https://junglewise.ai/threats/cve-2026-55630-kiwi-tcms-stored-xss-in-testplan-and-testcase-extra-link-fields)
- [Kiwi TCMS open redirect in account confirmation endpoint](https://junglewise.ai/threats/cve-2026-54724-kiwi-tcms-open-redirect-in-account-confirmation-endpoint)
- [PYSEC-2026-1499 - Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox](https://junglewise.ai/threats/cve-2023-36809-kiwi-tcms-s-misconfigured-http-headers-allow-stored-xss-execution)