6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23626

CVE-2026-23626: Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)

Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (DefaultPolicy) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23626

CVE-2026-23626:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kimai/kimai	composer	< 2.46.0	2.46.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Server-Side Template Injection (SSTI) within Kimai's export functionality. The root cause lies in the App\Twig\SecurityPolicy\DefaultPolicy class, which was used by the Twig sandbox for security checks during template rendering. Crucially, the checkMethodAllowed and checkPropertyAllowed methods within this policy were empty, effectively disabling any security restrictions. This allowed an attacker with permissions to control export templates to execute arbitrary code on the server by embedding malicious Twig syntax in a template file. The exploit demonstrates the ability to access sensitive environment variables (APP_SECRET, DATABASE_URL), all user password hashes, and session tokens. The patch remediates this by adding strict validation logic to the DefaultPolicy to block access to sensitive objects and methods, following a deny-by-default approach.

Vulnerable functions

App\Twig\SecurityPolicy\DefaultPolicy::checkMethodAllowed

src/Twig/SecurityPolicy/DefaultPolicy.php

Prior to the patch, this method was empty. It is part of the Twig sandbox and is responsible for validating whether a method call is allowed within a template. Its empty implementation meant that any method could be called on any object available in the template context, which is the root cause of the Server-Side Template Injection (SSTI) vulnerability. The patch adds logic to block calls to sensitive methods and objects.

App\Twig\SecurityPolicy\DefaultPolicy::checkPropertyAllowed

src/Twig/SecurityPolicy/DefaultPolicy.php

Similar to `checkMethodAllowed`, this function was empty before the patch, allowing unrestricted access to any object properties within the Twig template. This allowed an attacker to read sensitive data directly from entity properties, such as user password hashes.

App\Export\Base\HtmlRenderer::render

src/Export/Base/HtmlRenderer.php

This function is a key component in the exploit chain. It takes a user-controllable template and renders it using the Twig engine. Because the Twig environment was configured with the vulnerable `ExportPolicy` (which used `DefaultPolicy`), this function becomes the entry point for executing the malicious SSTI payload.

App\Twig\SecurityPolicy\InvoicePolicy::checkMethodAllowed

src/Twig/SecurityPolicy/InvoicePolicy.php

This function was part of the security policy for invoice rendering. Before the patch, it delegated its checks to a `ChainPolicy` that included the vulnerable `DefaultPolicy`. This made invoice rendering susceptible to the same SSTI vulnerability if an attacker could control the invoice template. The patch refactors this to use the new, hardened `DefaultPolicy` directly.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.