CVE-2026-44298Disclosure(kimai / kimai)

LOWCVSS 4.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.

kimai CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw

Other references

https://github.com/kimai/kimai/releases/tag/2.56.0

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kimai

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

kimai

Products

kimai

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud152d
Disclosure
🚨*CVE* CVE-2026-44298 Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permissio… https://www.cve.org/CVERecord?id=CVE-2026-44298 ----- Traducción: CVE-2026-44298 Kim… http://infoflow.cloud`
Post summary
CVE-2026-44298 for the Kimai application is disclosed, detailing affected versions and user roles, but no PoC, exploit, active use, patch information, or debunking claim is provided.
0000026
76 followersView on X
CVE@CVEnew152d
Disclosure
CVE-2026-44298 Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permissio… https://www.cve.org/CVERecord?id=CVE-2026-44298
Post summary
The post announces CVE‑2026‑44298, detailing a role-based privilege escalation bug in Kimai versions 2.32.0‑2.55.x, without mentioning PoC, exploits, or active usage.
00000191
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	kimai	kimai	-	-	-

Explore more

Back to dashboard kimai CVEs kimai vulnerabilities