CVE-2026-23626

The record

Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.

Affected packages

Related vulnerabilities

• GHSA-jg2j-2w24-54cg Kimai has an Authenticated Server-Side Template Injection (SSTI) Same vulnerability
• CVE-2026-28685 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
• GHSA-v33r-r6h2-8wr7 Kimai's API invoice endpoint missing customer-level access control (IDOR) Also affects kimai/kimai
• GHSA-9278-6hcj-2p4j Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions Also affects kimai/kimai
• CVE-2019-25317 Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to… Also affects kimai/kimai
• GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability Also affects kimai/kimai
• CVE-2023-53957 Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal… Also affects kimai/kimai
• CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336