PT-2026-3401 · Kimai · Kimai

Huseynkhanli · Published 2026-01-18 · Updated 2026-02-18 · CVE-2026-23626

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.46.0

Description Kimai is a web-based multi-user time-tracking application. The export functionality utilizes a Twig sandbox with an overly permissive security policy (DefaultPolicy), enabling arbitrary method calls on objects within the template context. An authenticated user possessing export permissions can leverage this to deploy a malicious Twig template, potentially extracting sensitive information. This information includes environment variables, all user password hashes, serialized session tokens, and CSRF tokens.

Recommendations Update to version 2.46.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-23626

GHSA-JG2J-2W24-54CG

Affected Products

Kimai

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23626.json · Exploit
• https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg · Vendor Advisory
• https://github.com/kimai/kimai/commit/6a86afb5fd79f6c1825060b87c09bd1909c2e86f · Patch
• https://osv.dev/vulnerability/GHSA-jg2j-2w24-54cg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23626 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23626 · Vendor Advisory
• https://github.com/kimai/kimai · Note
• https://github.com/kimai/kimai/pull/5757 · Note
• https://github.com/kimai/kimai/releases/tag/2.46.0 · Note
• https://twig.symfony.com/doc/3.x/api.html#sandbox-extension · Note
• https://twitter.com/VulmonFeeds/status/2013037455428006120 · Twitter Post
• https://twitter.com/CVEnew/status/2013021919998570695 · Twitter Post
• https://t.me/cveNotify/152364 · Telegram Post