CVE-2026-44298 Details
Description
Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.
A vulnerability allowing arbitrary file read has been identified in Kimai, an open-source time tracking application. This issue affects versions 2.32.0 prior to 2.56.0. The vulnerability arises when users with the System-Admin role and the permission to upload invoice templates can manipulate PDF files to access and embed any readable file from the PHP worker into the PDF invoice. The problem is rooted in the PDF rendering process, where uploaded templates can specify associated files that are then read and included in the PDF output.
Users can upgrade to Kimai version 2.56.0, where this vulnerability has been patched. Instructions for downloading the latest version are available on the Kimai GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kimai/kimai/releases/tag/2.56.0 | [email protected] | Release Notes |
| https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kimai kimai | >= 2.32.0, < 2.56.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |