Vulnerabilities

TI-2026-32268 CVE-2026-44298 · GHSA-h5fh-7hwr-97mw

Kimai: Arbitrary file read in invoice PDF renderer (admin)

LOW 22

Kimai is an open-source time tracking application.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00278 Published 2026-05-08 Fixed in 2.56.0, 2.56 CWE-22

TI-2026-30084 CVE-2026-41498 · GHSA-jv9x-w4gm-hwcm

Kimai: Team API Missing Object-Level Authorization

MEDIUM 49

Kimai is an open-source time tracking application.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00247 Published 2026-05-08 Fixed in 2.54.0 CWE-862

TI-2026-30580 CVE-2026-42267 · GHSA-3xc2-h5r3-wv3r

Kimai: Formula Injection via tag names in XLSX export

MEDIUM 58

Kimai is an open-source time tracking application.

CVSS 4.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0022 Published 2026-05-08 Fixed in 2.54.0 CWE-1236

TI-2026-29237 CVE-2026-40486 · GHSA-qh43-xrjm-4ggp

Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate

MEDIUM 53

Kimai is an open-source time tracking application.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00267 Published 2026-04-17 Fixed in 2.53.0 CWE-915

TI-2026-29230 CVE-2026-40479 · GHSA-g82g-m9vx-vhjg

Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

MEDIUM 58

Kimai is an open-source time tracking application.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00207 Published 2026-04-17 Fixed in 2.53.0 CWE-79

TI-2026-22900 CVE-2026-28685 · GHSA-v33r-r6h2-8wr7

Kimai: API invoice endpoint missing customer-level access control (IDOR)

MEDIUM 62

Kimai is a web-based multi-user time-tracking application.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0045 Published 2026-03-06 Fixed in 2.51.0 CWE-285

TI-2019-15371 CVE-2019-25317 · GHSA-9278-6hcj-2p4j

Kimai 2- persistent cross-site scripting (XSS)

MEDIUM 56

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00297 Published 2026-02-11 Fixed in 1.1 CWE-79

TI-2026-19027 CVE-2026-23626 · GHSA-jg2j-2w24-54cg

Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)

LOW 30

Kimai is a web-based multi-user time-tracking application.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00462 Published 2026-01-18 Fixed in 2.46.0 CWE-1336

TI-2023-30240 CVE-2023-53957 · GHSA-cv8h-r7r5-vwj9

Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking

HIGH 78

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00592 Published 2025-12-19 No fix listed CWE-1275

TI-2024-04278 CVE-2024-4596 · GHSA-6f3v-2r2j-2rpr

Kimai Session information disclosure

LOW 30

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0079 Published 2024-05-07 Fixed in 2.16.0 CWE-200

TI-2024-19369 CVE-2024-29200 · GHSA-cj3c-5xpm-cx94

API returns timesheet entries a user should not be authorized to view

LOW 31

Kimai is a web-based multi-user time-tracking application.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00644 Published 2024-03-28 Fixed in 2.13.0 CWE-1220

TI-2023-24872 CVE-2023-46245 · GHSA-fjhg-96cp-6fcw

Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

LOW 35

Kimai is a web-based multi-user time-tracking application.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01799 Published 2023-10-31 Fixed in 2.1.0 CWE-1336

TI-2020-13713 CVE-2020-19825 · GHSA-r58m-v5pr-jhhq

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in…

MEDIUM 44

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00697 Published 2023-02-15 Fixed in 1.1 CWE-79

TI-2021-19410 CVE-2021-43515 · GHSA-64fq-9c6w-rq44

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new…

LOW 36

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01014 Published 2022-04-08 Fixed in 1.14.1 CWE-1236

Vulnerabilities

Filters