CVE-2026-23626

Katalog CVE

CVSS 6.8 · Medium EPSS 0,45%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine pada kimai. Skor CVSS 3.1 6.8 (Medium) menurut github.com.

Deskripsi (NVD)

Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.

Rincian

Terbit di NVD

18 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg exploit · mitigasi · advisory vendor
• https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f patch
• https://github.com/kimai/kimai/pull/5757 issue tracking
• https://github.com/kimai/kimai/releases/tag/2.46.0 product · release notes