CVE-2026-44298

Medium

Description

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.

SeverityMedium

CVSS4.1

Exploit probability—

ProductKimai

PublishedMay 8, 2026

First seenMay 8, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

kimai kimai2.56.0 or later
kimai/kimai2.56 or later

Affected products

Product	Affected versions	Fixed in
kimai kimai	2.32.0 ≤ v < 2.56.0	2.56.0
kimai/kimaiPackagist	2.32.0 ≤ v < 2.56	2.56

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.