CVE-2023-46245

Published: Oct 31, 2023Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

Affected (1)

Products: Kimai: Kimai

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kimai Kimai	Up to 2.10

Related CWEs

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References (4)

https://github.com/kimai/kimai/commit/38e37f1c2e91e1acb221ec5c13f11b735bd50ae4

Source: security-advisories@github.com

https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcw

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/kimai/kimai/commit/38e37f1c2e91e1acb221ec5c13f11b735bd50ae4

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcw

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.