CVE-2026-44298

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44298
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44298.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44298
Aliases
Published
2026-05-08T03:32:06Z
Modified
2026-08-12T03:51:12Z
Severity
  • 4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Kimai: Arbitrary file read in invoice PDF renderer (admin)
Details

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44298.json"
}
References

Affected packages

Git / github.com/kimai/kimai

Affected ranges

Type
GIT
Repo
https://github.com/kimai/kimai
Events
Introduced
9ca69e11140deb1da6b2756d931b449beca7880d
Fixed
ebb54e9c0c5c6ae342bcff3bf63beebfda838cfd
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.32.0"
        },
        {
            "fixed": "2.56.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.32.0
2.33.0
2.34.0
2.35.0
2.35.1
2.36.0
2.36.1
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
2.53.0
2.54.0
2.55.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44298.json"