CVE-2026-23626 json
Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
published 2026-01-18 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-3403 , GHSA-jg2j-2w24-54cg
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.
Patch / fix
- packagist kimai/kimai 2.46.0
- kimai kimai 2.46.0
- github.com/kimai/kimai@6a86afb commit
- github.com/kimai/kimai#5757 pull request
- github.com/kimai/kimai/releases/tag/2.46.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | kimai/kimai | <2.46.0 |
2.46.0 |
Affected products
- kimai kimai
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/kimai/kimai/pull/5757
web, issue-tracking
-
github.com
/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f
web, patch
-
github.com
/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg
web, exploit, mitigation, vendor-advisory
-
github.com
/kimai/kimai/releases/tag/2.46.0
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-23626
advisory
-
github.com
/kimai/kimai
package
-
twig.symfony.com
/doc/3.x/api.html#sandbox-extension
web
Sources
- CVE List CVE-2026-23626
- GitHub Advisory GHSA-jg2j-2w24-54cg
- NVD CVE-2026-23626
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.