PT-2026-37257 · Openspout+1 · Openspout+1

Satexd · Published 2026-05-05 · Updated 2026-05-09 · CVE-2026-42267

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kimai versions 2.27.0 through 2.53.x

Description Users with ROLE USER privileges can create a tag containing a formula string (such as =SUM(54+51)) via the 'POST /api/tags' endpoint and assign it to a timesheet. The ArrayFormatter.formatValue() function joins tag names using implode() without sanitization. Consequently, when an administrator exports timesheets to XLSX format, the OpenSpout library treats any string prefixed with = as a FormulaCell, writing it into the archive. This allows the formula to be evaluated by Excel when the file is opened. The issue stems from the ArrayFormatter failing to call sanitizeDDE() and the API permitting formula trigger characters like =, +, -, and @ in tag names.

Recommendations Update to version 2.54.0. As a temporary workaround, avoid creating tags that begin with =, +, -, or @ and restrict the use of the 'POST /api/tags' endpoint for untrusted users.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2026-42267

GHSA-3XC2-H5R3-WV3R

Affected Products

Kimai

Openspout

References · 9

• 🔥 https://github.com/kimai/kimai/security/advisories/GHSA-3xc2-h5r3-wv3r · Exploit
• https://osv.dev/vulnerability/GHSA-3xc2-h5r3-wv3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42267 · Security Note
• https://github.com/kimai/kimai · Note
• https://github.com/kimai/kimai/releases/tag/2.54.0 · Note
• https://twitter.com/CVEnew/status/2053174715443769630 · Twitter Post
• https://t.me/CVEtracker/53067 · Telegram Post
• https://twitter.com/CVEarity/status/2052806607009145211 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053175980017979708 · Twitter Post