【低危】kiwitcms 安全更新（GHSA-v8rp-6xcv-fwgh）

安全情报快照 · 风险级别：低危 · CVE-2026-49292 · GHSA-v8rp-6xcv-fwgh

先看结论

kiwitcms存在安全风险，<= 12.4 受影响。上游暂未提供明确修复版本。

影响范围

生态	组件	受影响版本	首个修复版本
pip	`kiwitcms`	<= 12.4	—

处置建议

上游公告暂未给出明确修复版本。请持续关注项目维护者发布的补丁，并结合受影响版本范围排查资产。

上游技术详情（原文）

Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.

Impact

The /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!

While that looks serious at first the /init-db/ page is merely a proxy behind the /Kiwi/manage.py migrate command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:

Running migrations:
  No migrations to apply.

as shown on the screenshots below:

There is no data loss because migrations result in a no-op if they are already applied!
No application state is altered because all state changes have already been applied!
No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!

Remediation

The /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。