CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
Authenticated users can exploit Server-Side Template Injection in Kimai's export feature to extract sensitive data like password hashes and session tokens.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23626?
CVE-2026-23626 is a medium-severity code injection vulnerability in kimai, published on 18 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.
Weakness: CWE-1336
Which versions are affected by CVE-2026-23626?
2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | All versions | 2.46.0 |
kimai/kimai Packagist | All versions | 2.46.0 |
Products include Kimai Kimai.
How do I fix CVE-2026-23626?
Upgrade kimai/kimai to 2.46.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-23626 being exploited?
There is no known exploitation of CVE-2026-23626 in the wild and no public exploit code.
Other vulnerabilities in kimai
- CVE-2020-19825 Cross-site Scripting in kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
- CVE-2021-43515 Improper Neutralization of Formula Elements in a CSV File in Kimai 2
- CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
- CVE-2024-29200 API returns timesheet entries a user should not be authorized to view
Sources
Also known as GHSA-jg2j-2w24-54cg.