Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:NKimai
APPKimai2.32.0 – 2.56.0 (excl.)
Related vulnerabilities
XSS w Kimai 2 umożliwiający eskalację uprawnień
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies thr...
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-...
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By f...
Kimai to otwarte oprogramowanie do śledzenia czasu pracy. W wersjach od 2.27.0 do przed 2.54.0, każdy użytkown...