What is the CVSS score of CVE-2026-44298?

CVE-2026-44298 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44298?

Yes, a patch is available for CVE-2026-44298. Update the affected software to the latest version immediately.

Kimai CVE-2026-44298

EUVD-2026-28517 MEDIUM

Path Traversal (CWE-22)

2026-05-08 GitHub_M

GHSA-h5fh-7hwr-97mw

PHP Path Traversal

4.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.1 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 08, 2026 - 05:31 EUVD

Source Code Evidence Fetched

May 08, 2026 - 04:35 vuln.today

Analysis Generated

May 08, 2026 - 04:35 vuln.today

CVE Published

May 08, 2026 - 03:32 nvd

MEDIUM 4.1

DescriptionGitHub Advisory

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.

AnalysisAI

Kimai versions 2.32.0 through 2.55.x allow System-Admin users with invoice template upload permission to read arbitrary files from the PHP server via malicious PDF invoice templates. The vulnerability exploits mPDF's SetAssociatedFiles() function combined with unsanitized Twig template rendering to access any file readable by the PHP worker process and embed it within generated PDF invoices. No public exploit code or active exploitation has been identified; patch available in version 2.56.0.

Technical ContextAI

Kimai's invoice template feature uses Twig template rendering to generate PDF documents via the mPDF library. The vulnerability stems from insufficient whitelisting of PDF context options passed to mPDF through the sandboxed Twig environment. When a System-Admin uploads a malicious PDF invoice template containing pdfContext.setOption('associated_files', ...), the application forwards this directly to mPDF's SetAssociatedFiles() method. During PDF output generation, mPDF's writer calls file_get_contents() on each file path in the associated_files array without path validation, allowing traversal attacks (CWE-22). The attacker's file contents are then embedded as FlateDecode streams within the output PDF, which is returned to the user. This is a post-authentication information disclosure vulnerability requiring elevated permissions (ROLE_SYSTEM_ADMIN) and specific upload capability.

RemediationAI

Upgrade Kimai to version 2.56.0 or later immediately. The vendor's fix (PR #5924) implements whitelist validation of PDF context options, preventing arbitrary option injection including 'associated_files'. To upgrade, update your Kimai installation using git (git checkout 2.56.0) or download the release from https://github.com/kimai/kimai/releases/tag/2.56.0, then run database migrations if required. Note that version 2.56.0 requires PHP 8.2 minimum; if still on PHP 8.1 or earlier, upgrade PHP first to 8.2 or 8.5 as PHP 8.1 is end-of-life. If immediate upgrade is not possible, restrict the 'upload_invoice_template' permission to only trusted administrators and audit existing invoice templates for malicious content. Monitor PHP worker file access logs for unusual file_get_contents() calls targeting sensitive paths outside the Kimai application directory.