CVE-2026-23626
📋 TL;DR
This vulnerability allows authenticated users with export permissions in Kimai time-tracking software to deploy malicious Twig templates that bypass security sandboxing. Attackers can extract sensitive information including environment variables, password hashes, session tokens, and CSRF tokens. All Kimai installations prior to version 2.46.0 are affected.
💻 Affected Systems
- Kimai
📦 What is this software?
Kimai by Kimai
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Kimai instance with extraction of all user credentials, session tokens, and sensitive environment data leading to full system takeover.
Likely Case
Unauthorized access to sensitive user data including password hashes and session tokens, potentially enabling account takeover and lateral movement.
If Mitigated
Limited impact if proper access controls restrict export permissions to trusted users only.
🎯 Exploit Status
Exploitation requires authenticated access with export permissions; the vulnerability is in a widely used template engine with known exploitation patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.46.0
Vendor Advisory: https://github.com/kimai/kimai/security/advisories/GHSA-jg2j-2w24-54cg
Restart Required: Yes
Instructions:
1. Backup your Kimai installation and database. 2. Update to version 2.46.0 or later via git pull or package manager. 3. Clear cache: bin/console cache:clear. 4. Restart web server. 5. Verify update with bin/console kimai:version.
🔧 Temporary Workarounds
Restrict Export Permissions
allTemporarily remove export permissions from all non-essential users until patching can be completed.
# Modify user roles in Kimai admin interface to remove export permissions
Disable Export Functionality
allTemporarily disable the export feature entirely via configuration or code modification.
# Comment out or remove export-related routes in config/routes.yaml
🧯 If You Can't Patch
- Implement strict access controls to limit export permissions to absolutely necessary users only.
- Monitor export activity logs for suspicious template usage or unusual export patterns.
🔍 How to Verify
Check if Vulnerable:
Check Kimai version: if version is below 2.46.0, system is vulnerable.Check Version:
bin/console kimai:versionVerify Fix Applied:
Verify version is 2.46.0 or higher and test export functionality with safe templates.📡 Detection & Monitoring
Log Indicators:
- Unusual export activity
- Template compilation errors
- Large data exports
Network Indicators:
- Unusual POST requests to export endpoints
- Large data transfers from export functionality
SIEM Query:
source="kimai" AND (event="export" OR event="template") AND size>1000000