【中危】kiwitcms：开放重定向风险（GHSA-hmj5-jm8h-h9fh）

安全情报快照 · 风险级别：中危 · CVSS：6.1 · CVE-2026-54724 · GHSA-hmj5-jm8h-h9fh

先看结论

kiwitcms存在开放重定向风险，<= 12.4 受影响。上游暂未提供明确修复版本。

影响范围

生态	组件	受影响版本	首个修复版本
pip	`kiwitcms`	<= 12.4	—

处置建议

上游公告暂未给出明确修复版本。请持续关注项目维护者发布的补丁，并结合受影响版本范围排查资产。

上游技术详情（原文）

Summary

An open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to craft a URL hosted on a legitimate Kiwi TCMS instance that redirects victims to an arbitrary external domain. The attack surface is particularly relevant for phishing campaigns targeting Kiwi TCMS users, as the malicious link originates from a trusted organizational hostname.

Impact

This is an open redirect vulnerability (CWE-601). Any unauthenticated attacker can exploit it against any user of a Kiwi TCMS deployment.

The primary risk is phishing. Because Kiwi TCMS is typically deployed as an internal tool for engineering and QA teams, a redirect from the organization's own hostname carries high implicit trust. An attacker can use this endpoint to:

Redirect victims to a credential-harvesting page styled to match the Kiwi TCMS or corporate SSO login.
Bypass email security filters and link-reputation checks that allowlist the organization's domain.
Distribute malware via a convincing "confirm your account" lure.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。