CVE-2026-44298 Kimai: Arbitrary file read in invoice PDF renderer (admin)
Admins can read arbitrary server files by uploading malicious PDF templates, exposing sensitive data to attackers with admin privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44298?
CVE-2026-44298 is a medium-severity path traversal vulnerability in kimai, published on 8 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-44298?
2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | From 2.32.0 | 2.56 |
kimai/kimai Packagist | From 2.32.0 | 2.56 |
Products include Kimai Kimai.
How do I fix CVE-2026-44298?
Upgrade kimai/kimai to 2.56 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44298 being exploited?
There is no known exploitation of CVE-2026-44298 in the wild and no public exploit code.
Other vulnerabilities in kimai
- CVE-2020-19825 Cross-site Scripting in kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
- CVE-2021-43515 Improper Neutralization of Formula Elements in a CSV File in Kimai 2
- CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
- CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
Sources
Also known as GHSA-h5fh-7hwr-97mw.