Read the docs
TI-2026-02684 Aliases CVE-2026-3107GHSA-65q8-p76v-6qj6

Multiple vulnerabilities in Teampass

Priority MEDIUM 47CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed Teampass (Teampass): 3.1.5.24

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nilsteampassnetTeampassup to 3.1.5.163.1.5.24Patch availableCNA
  • Teampass Vendornilsteampassnet Affected up to 3.1.5.16 Fixed in 3.1.5.24 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:*3.1.5.16 to before 3.1.5.24Vulnerablenilsteampassnet
  • cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:* Versions 3.1.5.16 to before 3.1.5.24 Vulnerable ·nilsteampassnet

Remediation

  • Fix · CNA Teampass (Teampass) Fixed in 3.1.5.24

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3107
  2. 2026-10-03 Alias added: GHSA-65q8-p76v-6qj6

References

Patch 1

  • TI-2023-02892 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass CVSS 3.1CRITICAL 9.0
  • TI-2023-03315 Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass CVSS 3.1HIGH 7.5
  • TI-2023-01459 SQL Injection in nilsteampassnet/teampass CVSS 3.1HIGH 7.5
  • TI-2023-02679 Code Injection in nilsteampassnet/teampass CVSS 3.1HIGH 8.8
  • TI-2023-03313 Code Injection in nilsteampassnet/teampass CVSS 3.1HIGH 7.2
  • TI-2023-01013 External Control of File Name or Path in nilsteampassnet/teampass CVSS 3.1HIGH 7.1
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences