CVE-2026-40479 Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
Authenticated users can inject JavaScript via profile aliases, leading to stored XSS and privilege escalation when administrators view team forms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40479?
CVE-2026-40479 is a medium-severity cross-site scripting vulnerability in kimai, published on 17 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quote or single quote characters. When a user's profile alias is inserted into an HTML attribute context via the team member form prototype and rendered through innerHTML, this incomplete escaping allows HTML attribute injection. An authenticated user with ROLE_USER privileges can store a malicious alias that executes JavaScript in the browser of any administrator viewing the team form, resulting in stored XSS with privilege escalation. This issue has been fixed in version 2.53.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-40479?
2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | All versions | 2.53.0 |
kimai/kimai Packagist | All versions | 2.53.0 |
Products include Kimai Kimai.
How do I fix CVE-2026-40479?
Upgrade kimai/kimai to 2.53.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-40479 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40479 exists.
Other vulnerabilities in kimai
- CVE-2020-19825 Cross-site Scripting in kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
- CVE-2021-43515 Improper Neutralization of Formula Elements in a CSV File in Kimai 2
- CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
- CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
Sources
Also known as GHSA-g82g-m9vx-vhjg.