Cybozu Garoon XSS Vulnerability Advisory (CVE-2026-22881)

Critical Vulnerability Information Vulnerability Title and Details CVE ID: CVE-2026-22881 Affected Versions: 5.15.0, 5.15.1, 5.15.2, 6.0.0, 6.0.1, 6.0.2, 6.0.3 Fixed Version: 6.17.0 Disclosure Date: 2026-01-30 Update Date: 2026-01-30 Vulnerability Description Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS Base Score: 5.7 (Medium/Warning) - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None Additional Information Due to potential exploitation risks, reproduction steps are not publicly disclosed. Vulnerability assessment conducted using CVSS v3: https://www.ipa.go.jp/security/vuln/CVSSv3.html Related Links CVE: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22881 Disclosure Policy Vulnerability Information Handling Policy: https://cybozu.co.jp/company/security-policy/ JVN: https://jvn.jp/nav/jvn.html Mitigation Strategy For Garoon versions 5 and earlier, no fixes are provided for vulnerabilities with CVSS base scores below 6.9 in versions 6.0 and below. Package Edition Garoon Mitigation Measures: https://garoon.cybozu.co.jp/support/package/update/#policy Workarounds / Mitigation The issue has been resolved in subsequent versions. Consider upgrading to a newer version. Recommended Version: Garoon 6.17.0 and later

Goal Reached Thanks to every supporter — we hit 100%!

Cybozu Garoon XSS Vulnerability Advisory (CVE-2026-22881)