CVE-2023-46245 HIGH

CVE-2023-46245: Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

Vendor Kimai
Product kimai
Weakness CWE-1336
Published October 31, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

Key dates

02Disclosure timeline

October 31, 2023 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-66297 Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection CVE-2025-40900 Angular template injection in Reports in Guardian/CMC before 26.1.0 CVE-2024-6386 WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection CVE-2026-39980 OpenCTI affected by RCE via notifier template CVE-2026-28784 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI