Read the docs
TI-2019-15371 Aliases CVE-2019-25317GHSA-9278-6hcj-2p4j

Kimai 2- persistent cross-site scripting (XSS)

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed kimai/kimai (Packagist): 1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kevinpapstKimai2—No fix listedCNA
—kimai/kimai (Packagist)before 1.11.1Patch availableGHSA-9278-6hcj-2p4j
  • Kimai Vendorkevinpapst Affected 2 Fixed in — No fix listed CNA
  • kimai/kimai (Packagist) Vendor— Affected before 1.1 Fixed in 1.1 Patch available GHSA-9278-6hcj-2p4j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*up to 1.1Vulnerablekimai
  • cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:* Versions up to 1.1 Vulnerable ·kimai

Remediation

  • Fix · GHSA-9278-6hcj-2p4j kimai/kimai (Packagist) Fixed in 1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25317
  2. 2026-10-03 Alias added: GHSA-9278-6hcj-2p4j

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2023-30240 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking CVSS 4.0HIGH 8.5
  • TI-2026-22900 Kimai: API invoice endpoint missing customer-level access control (IDOR) CVSS 3.1MEDIUM 6.5
  • TI-2026-30580 Kimai: Formula Injection via tag names in XLSX export CVSS 4.0MEDIUM 5.4
  • TI-2026-29230 Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget CVSS 3.1MEDIUM 5.4
  • TI-2026-29237 Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate CVSS 3.1MEDIUM 4.3
  • TI-2026-30084 Kimai: Team API Missing Object-Level Authorization CVSS 3.1LOW 3.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences