-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kevinpapst/kimai2 | composer | < 1.14.1 | 1.14.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of formula elements in CSV exports. The patch commit shows changes in AbstractSpreadsheetRenderer where DDE payload sanitization was added. Prior to 1.14.1, the export functionality didn't escape formula-initiating characters in user-controlled fields like description. The addRowToSheet method (or similar CSV rendering logic) would be the point where untrusted data enters CSV output without sanitization, making it the vulnerable function. The high confidence comes from: 1) CWE-1236 mapping to CSV formula injection, 2) patch focusing on spreadsheet rendering, and 3) vulnerability description implicating CSV export of timesheet descriptions.
Ongoing coverage of React2Shell