CVE-2026-44298

Descripción

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption(-associated_files-, ...) inside the sandboxed Twig render. This is forwarded to mPDF-s SetAssociatedFiles(), whose writer calls file_get_contents($entry[-path-]) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.