https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 15:27:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266128 EUVD-2026-266128 https://cve.radiocsirt.org/vuln/euvd-2026-266128 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23626 <p>Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai&#39;s export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.</p> <p>Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai&#39;s export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23626 https://cve.radiocsirt.org/vuln/ghsa-jg2j-2w24-54cg <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p># Kimai 2.45.0 - Authenticated Server-Side Template Injection (SSTI)</p> <p>## Vulnerability Summary</p> <p>| Field | Value | |-------|-------| | **Title** | Authenticated SSTI via Permissive Export Template Sandbox || **Attack Vector** | Network | | **Attack Complexity** | Low | | **Privileges Required** | High (Admin with export permissions and server access) | | **User Interaction** | None | | **Impact** | Confidentiality: HIGH (Credential/Secret Extraction) | | **Affected Versions** | Kimai 2.45.0 (likely earlier versions) | | **Tested On** | Docker: kimai/kimai2:apache-2.45.0 | | **Discovery Date** | 2026-01-05 |</p> <p>---</p> <p>**Why Scope is &#34;Changed&#34;:** The extracted `APP_SECRET` can be used to forge Symfony login links for ANY user account, expanding the attack beyond the initially compromised admin context.</p> <p>---</p> <p>## Vulnerability Description</p> <p>Kimai&#39;s export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including:</p> <p>1. **Environment Variables** (APP_SECRET, DATABASE_URL) 2. **All User Password Hashes** (bcrypt) 3. **Serialized Session Tokens** 4. **CSRF Tokens**</p> <p>---</p> <p>## Prerequisites</p> <p>1. **Authenticated Access**: Valid account with export permissions (typically ROLE_ADMIN, ROLE_SUPER_ADMIN, or ROLE_TEAMLEAD) 2. **Template Deployment**: Ability…</p> <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p># Kimai 2.45.0 - Authenticated Server-Side Template Injection (SSTI)</p> <p>## Vulnerability Summary</p> <p>| Field | Value | |-------|-------| | **Title** | Authenticated SSTI via Permissive Export Template Sandbox || **Attack Vector** | Network | | **Attack Complexity** | Low | | **Privileges Required** | High (Admin with export permissions and server access) | | **User Interaction** | None | | **Impact** | Confidentiality: HIGH (Credential/Secret Extraction) | | **Affected Versions** | Kimai 2.45.0 (likely earlier versions) | | **Tested On** | Docker: kimai/kimai2:apache-2.45.0 | | **Discovery Date** | 2026-01-05 |</p> <p>---</p> <p>**Why Scope is &#34;Changed&#34;:** The extracted `APP_SECRET` can be used to forge Symfony login links for ANY user account, expanding the attack beyond the initially compromised admin context.</p> <p>---</p> <p>## Vulnerability Description</p> <p>Kimai&#39;s export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including:</p> <p>1. **Environment Variables** (APP_SECRET, DATABASE_URL) 2. **All User Password Hashes** (bcrypt) 3. **Serialized Session Tokens** 4. **CSRF Tokens**</p> <p>---</p> <p>## Prerequisites</p> <p>1. **Authenticated Access**: Valid account with export permissions (typically ROLE_ADMIN, ROLE_SUPER_ADMIN, or ROLE_TEAMLEAD) 2. **Template Deployment**: Ability…</p> https://cve.radiocsirt.org/vuln/ghsa-jg2j-2w24-54cg