Web-based Time-Tracking Application Vulnerability in Kimai

CVE-2026-23626

What is CVE-2026-23626?

The Kimai web-based time-tracking application has a vulnerability in its export functionality, which prior to version 2.46.0, utilized a Twig sandbox with a lenient security configuration. This flaw allows an authenticated user with export permissions to execute harmful Twig templates, potentially exposing sensitive data such as environment variables, user password hashes, and serialized session tokens. Version 2.46.0 addresses this critical issue by reinforcing the security measures of the Twig sandbox, mitigating the risk of unauthorized data access.

References