Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.
References
| Link | Resource |
|---|---|
| https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f | Patch |
| https://github.com/kimai/kimai/pull/5757 | Issue Tracking |
| https://github.com/kimai/kimai/releases/tag/2.46.0 | Product Release Notes |
| https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg | Exploit Mitigation Vendor Advisory |
Configurations
History
18 Feb 2026, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Kimai
Kimai kimai |
|
| CPE | cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:* | |
| References | () https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f - Patch | |
| References | () https://github.com/kimai/kimai/pull/5757 - Issue Tracking | |
| References | () https://github.com/kimai/kimai/releases/tag/2.46.0 - Product, Release Notes | |
| References | () https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg - Exploit, Mitigation, Vendor Advisory |
18 Jan 2026, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-18 23:15
Updated : 2026-02-18 16:30
NVD link : CVE-2026-23626
Mitre link : CVE-2026-23626
CVE.ORG link : CVE-2026-23626
JSON object : View
Products Affected
kimai
- kimai
CWE
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine