CVE-2026-42267 Details
Description
Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened. This issue has been patched in version 2.54.0.
A formula injection vulnerability has been identified in Kimai, an open-source time tracking application, affecting versions 2.27.0 prior to 2.54.0. Any user with the ROLE_USER can create a tag containing a formula string, such as '=SUM(54+51)', and assign it to a timesheet. When an admin exports timesheets to XLSX, the application does not sanitize the tag names, allowing Excel to evaluate the injected formulas. This issue has been patched in version 2.54.0.
Users can update to Kimai version 2.54.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kimai/kimai/security/advisories/GHSA-3xc2-h5r3-wv3r | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/kimai/kimai/releases/tag/2.54.0 | [email protected] | ProductRelease Notes |
| https://github.com/kimai/kimai/security/advisories/GHSA-3xc2-h5r3-wv3r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kimai kimai | >= 2.27.0, < 2.54.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |