Description
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kimai | kimai | < 2.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | kimai/kimai | < 2.1.0 | 2.1.0 | GHSA-fjhg-96cp-6fcw |