CVE-2026-42267
medium
CVSS v3
5.7
CVSS v2
—
VIR risk
5.7
Description
Kimai vulnerable to formula Injection via tag names in XLSX export
Predictions
Exploit likelihood
67%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security-advisories@github.com — https://github.com/kimai/kimai/security/advisories/GHSA-3xc2-h5r3-wv3r
Vendor advisory: security-advisories@github.com — https://github.com/kimai/kimai/releases/tag/2.54.0
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | kimai/kimai | >=2.27.0,<=2.53.0 | |
| Packagist | kimai/kimai | >=2.27.0,<2.54.0 | 2.54.0 |
| COMPOSER | kimai/kimai | >= 2.27.0, <= 2.53.0 | 2.54.0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| kimai | kimai | {"startIncluding":"2.27.0","endExcluding":"2.54.0"} | 2.54.0 |
References
CWEs
CWE-1236
Verify integrity in audit chain (admin only). AS-IS.