Skip to content
OpenAdvisories
High · 7.8 CVE-2021-43515 EUVD-2022-1642GHSA-64fq-9c6w-rq44

Improper Neutralization of Formula Elements in a CSV File in Kimai 2

Published Apr 8, 2022 · Updated Aug 4, 2024 · Assigned by mitre

Package: kevinpapst/kimai2 Ecosystem: Packagist

Description

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist kevinpapst/kimai2 < 1.14.1 1.14.1 GHSA-64fq-9c6w-rq44

References