GHSA-jg2j-2w24-54cg
Medium · 6.8CVSS
6.8
EPSS
—
Published
Jan 20, 2026
CISA due date
—
The record
Kimai has an Authenticated Server-Side Template Injection (SSTI)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | kimai/kimai | 0 | 2.46.0 |
Related vulnerabilities
- CVE-2026-23626 Kimai is a web-based multi-user time-tracking application. Same vulnerability
- CVE-2026-28685 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
- GHSA-v33r-r6h2-8wr7 Kimai's API invoice endpoint missing customer-level access control (IDOR) Also affects kimai/kimai
- GHSA-9278-6hcj-2p4j Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions Also affects kimai/kimai
- CVE-2019-25317 Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to… Also affects kimai/kimai
- GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability Also affects kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal… Also affects kimai/kimai
- CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336