CVE-2023-46245
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.
- Affected products
- Kimai
- Kimai
- ≤ 2.10
- Fix
- Available
- CVSS 3.1
- 7.2 HIGH
- EPSS
- 1.5% (72th percentile)
- Weakness
- CWE-1336
- NVD status
- Modified
- Published
- 2023-10-31
CVE-2023-46245 at NVD
No indexed exploits for CVE-2023-46245 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2023-46245 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.