PT-2026-38651 · Mpdf+1 · Mpdf+1

Melnicek · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-44298

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kimai versions 2.32.0 through 2.55.x

Description Users with the System-Admin role (ROLE SYSTE ADMIN) and the upload invoice template permission can upload PDF invoice templates that execute pdfContext.setOption('associated files', ...) within the sandboxed Twig render. This request is forwarded to the SetAssociatedFiles() function of mPDF, which utilizes file get contents($entry['path']) during PDF output to embed bytes as a FlateDecode stream. Consequently, any file readable by the PHP worker can be retrieved by an attacker through the rendered invoice.

Recommendations Update Kimai to version 2.56.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-44298

GHSA-H5FH-7HWR-97MW

Affected Products

Kimai

Mpdf

References · 8

• https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44298 · Security Note
• https://osv.dev/vulnerability/GHSA-h5fh-7hwr-97mw · Vendor Advisory
• https://github.com/kimai/kimai · Note
• https://github.com/kimai/kimai/releases/tag/2.56.0 · Note
• https://twitter.com/CVEnew/status/2053174712478396685 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053175956278329688 · Twitter Post
• https://t.me/CVEtracker/53070 · Telegram Post