CyberRota Analysis
AI-GeneratedVersions of Kimai prior to 2.56.0 are vulnerable due to inadequate restrictions on the config() Twig function in sandboxed templates, enabling administrators to exploit this flaw. This could lead to the exfiltration of sensitive server-wide secrets, such as LDAP bind passwords and SAML private keys, into documents that are accessible to users with lower privileges. Organizations using Kimai, particularly those with administrative access, should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.