CVE-2026-117679
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A cross-site scripting vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
Risk Assessment
This can lead to theft of user sessions or credentials and actions performed on behalf of users. User accounts and application integrity are at risk.
Recommendation
Update SHIRASAGI to a version containing the fix. Deploy security headers (e.g., Content-Security-Policy) and input validation.
Other vulnerabilities in SHIRASAGI
See all- CVE-2026-118869High
An OS command injection vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary OS commands on the system running the product.
- CVE-2026-82582Medium
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
- CVE-2026-81635Medium
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
Original NVD description (English source)
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS