CVE-2026-49865 Details

A server-side request forgery (SSRF) vulnerability has been identified in Kimai, an open-source time tracking application, in versions prior to 2.58.0. The vulnerability arises in the invoice PDF preview and generation process. When an attacker can manipulate Markdown content that is later converted into an invoice PDF—such as the 'Customer.invoiceText'—the server-side PDF renderer retrieves remote image URLs embedded in the Markdown. This behavior allows the application server to make outbound requests to attacker-controlled or internal targets during PDF rendering. Such actions could be used for internal network probing, server-side reachability checks, and potentially more serious exploitation, depending on the deployment environment and accessible internal services.

Users are advised to update to Kimai version 2.58.0, where this vulnerability has been patched. In this version, Kimai no longer allows Markdown images in invoice texts and instead converts them to HTML links. Additionally, Kimai has implemented a specialized HttpClient for mPDF that restricts access to certain URLs, preventing potential exploitation.