NIXPKGS-2026-0044
published on
Permalink
CVE-2026-23626
6.8 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.
References
-
https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg x_refsource_CONFIRM
-
https://github.com/kimai/kimai/pull/5757 x_refsource_MISC
-
https://github.com/kimai/kimai/releases/tag/2.46.0 x_refsource_MISC
-
https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg x_refsource_CONFIRM
-
https://github.com/kimai/kimai/pull/5757 x_refsource_MISC
-
https://github.com/kimai/kimai/releases/tag/2.46.0 x_refsource_MISC
Affected products
kimai
- ==< 2.46.0
Package maintainers
-
@peat-psuwit Ratchanan Srirattanamet <peat@peat-network.xyz>