SHIRASAGI Project vulnerabilities and threats

CVE-2026-118869 is an OS command injection vulnerability in SHIRASAGI versions 1.19.0 through 1.21.0. It allows an authenticated attacker to execute arbitrary operating system commands on the affected system without user interaction. The vulnerability has a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.

CVE-2026-117679 is a cross-site scripting (XSS) vulnerability in the SHIRASAGI project that affects versions from 1.12.0 through 1.21.0. This vulnerability allows an authenticated attacker to execute arbitrary scripts in the web browser of users who access a website using the affected SHIRASAGI versions.

CVE-2026-82582 is an authorization bypass vulnerability in SHIRASAGI, a groupware project. The flaw arises from a user-controlled key that can be manipulated to access files in the shared file feature without proper authorization. This vulnerability affects SHIRASAGI versions from 0 up to and including 1.20.2. The issue has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.

CVE-2026-81635 is a cross-site scripting (XSS) vulnerability in the SHIRASAGI Project's SHIRASAGI product. This flaw allows an attacker to execute arbitrary scripts in the web browser of users who visit websites running affected versions of SHIRASAGI. The vulnerability affects versions from 1.14.0 through 1.20.2. The CVSS v3.0 base score is 5.4, indicating a medium severity level. There is no information about available patches or exploits in the wild.