CVE-2026-44298

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44298", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T17:39:31.113Z", "datePublished": "2026-05-08T03:32:06.672Z", "dateUpdated": "2026-05-08T14:06:31.033Z"}, "containers": {"cna": {"title": "Kimai: Arbitrary file read in invoice PDF renderer (admin)", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw"}, {"name": "https://github.com/kimai/kimai/releases/tag/2.56.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/kimai/kimai/releases/tag/2.56.0"}], "affected": [{"vendor": "kimai", "product": "kimai", "versions": [{"version": ">= 2.32.0, < 2.56.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T03:32:06.672Z"}, "descriptions": [{"lang": "en", "value": "Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0."}], "source": {"advisory": "GHSA-h5fh-7hwr-97mw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T14:06:21.498796Z", "id": "CVE-2026-44298", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T14:06:31.033Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44298", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:06:21.498796Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T14:06:26.617Z"}}], "cna": {"title": "Kimai: Arbitrary file read in invoice PDF renderer (admin)", "source": {"advisory": "GHSA-h5fh-7hwr-97mw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "kimai", "product": "kimai", "versions": [{"status": "affected", "version": ">= 2.32.0, < 2.56.0"}]}], "references": [{"url": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw", "name": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kimai/kimai/releases/tag/2.56.0", "name": "https://github.com/kimai/kimai/releases/tag/2.56.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T03:32:06.672Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44298", "state": "PUBLISHED", "dateUpdated": "2026-05-08T14:06:31.033Z", "dateReserved": "2026-05-05T17:39:31.113Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T03:32:06.672Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kimai", "vendor": "kimai", "versions": [{"status": "affected", "version": ">= 2.32.0, < 2.56.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*", "matchCriteriaId": "89508F96-AB37-476D-82CD-B4750C90BDD8", "versionEndExcluding": "2.56.0", "versionStartIncluding": "2.32.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0."}, {"lang": "es", "value": "Kimai es una aplicaci\u00f3n de seguimiento de tiempo de c\u00f3digo abierto. Desde la versi\u00f3n 2.32.0 hasta antes de la versi\u00f3n 2.56.0, los usuarios con el rol System-Admin (ROLE_SYSTE_ADMIN) y el permiso upload_invoice_template pueden subir plantillas de factura PDF, que pueden llamar a pdfContext.setOption(\u2019associated_files\u2019, ...) dentro del renderizado Twig en entorno aislado. Esto se reenv\u00eda a SetAssociatedFiles() de mPDF, cuyo escritor llama a file_get_contents ( $entry[\u2019path\u2019]) durante la salida del PDF y embebe los bytes como un flujo FlateDecode en el PDF. Cualquier archivo legible por el trabajador de PHP es devuelto al atacante dentro de la factura renderizada. Este problema ha sido parcheado en la versi\u00f3n 2.56.0."}], "id": "CVE-2026-44298", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44298", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T14:06:21.498796Z", "version": "2.0.3"}}]}, "published": "2026-05-08T04:16:24.230", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/kimai/kimai/releases/tag/2.56.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.32.0,2.56.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kimai", "source": "cna", "vendor": "kimai"}, "product": "kimai", "vendor": "kimai"}], "created": "2026-05-08T05:30:46.221872+00:00", "updated": "2026-05-08T06:00:10.640555+00:00", "vendors": ["kimai", "kimai$PRODUCT$kimai"]}