CVE-2026-81635
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
Risk Assessment
An attacker can execute a malicious script in the victim's browser context, potentially leading to session theft or other actions on behalf of the user.
Recommendation
Update SHIRASAGI to a patched version and implement appropriate security headers and input filtering.
Other vulnerabilities in SHIRASAGI
See all- CVE-2026-118869High
An OS command injection vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary OS commands on the system running the product.
- CVE-2026-117679Medium
A cross-site scripting vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
- CVE-2026-82582Medium
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
Original NVD description (English source)
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS