Is there a patch available for CVE-2026-42267?

Yes, a patch is available for CVE-2026-42267. Update the affected software to the latest version immediately.

Kimai CVE-2026-42267

Q: What is the CVSS score of CVE-2026-42267?

CVE-2026-42267 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-05-05 https://github.com/kimai/kimai

GHSA-3xc2-h5r3-wv3r

PHP Code Injection

5.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 08, 2026 - 04:22 NVD

5.4 (MEDIUM)

Source Code Evidence Fetched

May 05, 2026 - 21:33 vuln.today

Analysis Generated

May 05, 2026 - 21:33 vuln.today

DescriptionGitHub Advisory

Summary

Any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened.

Details

1. `ArrayFormatter` does not sanitize before returning

sanitizeDDE() exists on StringHelper and is called by TextFormatter, but ArrayFormatter never calls it.

php

// src/Export/Package/CellFormatter/ArrayFormatter.php:24
return implode(', ', $value);  // no sanitizeDDE() call

2. Tag name validation does not block formula trigger characters

The API blocks commas in tag names but permits =, +, -, and @ - all valid formula prefixes in Excel and LibreOffice Calc.

3. OpenSpout silently promotes strings to formula cells

Cell::fromValue("=SUM(54+51)") returns a FormulaCell with no warning.

PoC

It logs in as normal user, creates tag =SUM(54+51), assigns it to a timesheet.
Admin has to export timesheets to Excel version via /en/export/ endpoint.

Impact

Any ROLE_USER can plant a formula that executes on the workstation of any user who exports and opens timesheet data
A single malicious tag poisons all future exports across all users and date ranges until the tag is deleted

Fixes

Prevent = being part of the tag name (and other fields as well)
Use OpenSpout TextCell for everything that is a string

AnalysisAI

Formula injection in Kimai 2.27.0 through 2.53.0 allows authenticated users with ROLE_USER to create tags containing formula strings (e.g., =SUM(54+51)) via the POST /api/tags endpoint. When administrators export timesheets to XLSX format, the ArrayFormatter joins tag names without sanitization, and OpenSpout automatically promotes formula-prefixed strings to FormulaCell objects. Excel or LibreOffice Calc evaluates these formulas when the exported file is opened, enabling code execution on any workstation that imports and opens the poisoned spreadsheet. Publicly available exploit code demonstrates the attack via normal user account and admin export workflow.

Technical ContextAI

The vulnerability involves three converging technical failures in Kimai's XLSX export pipeline. First, the ArrayFormatter class (src/Export/Package/CellFormatter/ArrayFormatter.php) uses PHP's implode() function to join tag names without calling the existing sanitizeDDE() method that is available on StringHelper and used by TextFormatter elsewhere in the codebase. Second, tag name validation at the API level blocks commas but permits formula trigger characters (=, +, -, @) that are recognized by Excel and LibreOffice Calc as formula prefixes. Third, the underlying OpenSpout library (used by Kimai for XLSX generation) contains logic in its Cell::fromValue() method that automatically detects strings beginning with = and promotes them to FormulaCell objects, writing literal <f>...</f> XML elements into the XLSX archive structure. When Excel opens the file, it evaluates these formula cells without user confirmation, creating a formula injection attack vector. The root cause is insufficient input validation (CWE-1236: Improper Neutralization of Formula Elements in a CSV File) combined with inadequate output encoding for the XLSX format.

RemediationAI

Upgrade Kimai to version 2.54.0 or later, which includes fixes that prevent formula trigger characters in tag names and ensure tag values are exported as TextCell objects rather than formula cells. The vendor-released patch addresses both the input validation failure (blocking =, +, -, @ in tag names) and the output encoding failure (forcing string cells to be TextCell type in OpenSpout). If immediate upgrading is not feasible, a temporary compensating control is to disable XLSX export functionality in Kimai's configuration settings, though this severely restricts reporting capabilities and is not a long-term solution. Organizations should also audit existing tags in their Kimai instances for formula injection patterns (strings beginning with =, +, -, or @) and delete any malicious tags before updating. The workarounds do not address the underlying product flaw and should be considered temporary only. See GitHub advisory GHSA-3xc2-h5r3-wv3r for patch details and deployment guidance.