Vulnerability · Published Jan 18, 2026 · Assigned by GitHub_M

CVE-2026-23626Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)

Medium 6.8

In plain English

A medium-severity security flaw in kimai from kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 59.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kimai/kimai	2.46.0	GHSA-jg2j-2w24-54cg

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	< 2.46.0

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg x_refsource_CONFIRM
https://github.com/kimai/kimai/pull/5757 x_refsource_MISC
https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f x_refsource_MISC
https://github.com/kimai/kimai/releases/tag/2.46.0 x_refsource_MISC