CVE-2026-23626

MEDIUM EPSS 30.7%
Published Jan 18, 20265mo ago · Modified Jun 17, 20261w ago
6.8 CVSS 3.1
Medium
Find Similar
Published Jan 18, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.

CVSS Details

Base Score
6.8
Exploitability
2.3
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
30.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-1336

Affected Products 1

VendorProductVersionRange
kimaikimai* <2.46.0

References 4

  • github.com https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f
    Patch
  • github.com https://github.com/kimai/kimai/pull/5757
    Issue Tracking
  • github.com https://github.com/kimai/kimai/releases/tag/2.46.0
    ProductRelease Notes
  • github.com https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg
    ExploitMitigationVendor Advisory

Remediation

  • github.com https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f
    Patch