{"id":"CVE-2026-49865","title":"Kimai is an open-source time tracking application","summary":"Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is lat…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","cwe":["CWE-918"],"vendor":"kimai","product":"kimai","affected":["kimai < 2.58.0"],"patched":["kimai/kimai 2.58.0"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:16:44.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49865","references":[{"url":"https://github.com/kimai/kimai/security/advisories/GHSA-pj8j-p4g4-4vw8","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-pj8j-p4g4-4vw8"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T19:58:34.278739Z"},"cvssSource":"cna","epss":0.00327,"epssPercentile":0.26036,"exploits":{"github":1,"githubRepos":["https://github.com/cyeezy08/Kimai-CVE-2026-49865-POC"],"checkedAt":"2026-09-23T07:14:10.051Z"},"exploitAvailable":true,"aliases":["GHSA-pj8j-p4g4-4vw8"],"ecosystem":"composer","ingestedAt":"2026-07-10T16:05:09.804Z","slug":"CVE-2026-49865","body":"## Overview\n\nKimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as `Customer.invoiceText`, the server-side PDF renderer will fetch remote image URLs embedded in Markdown image syntax. This allows the application server to issue outbound requests to attacker-controlled or internal targets during PDF rendering. The behavior can be used for internal network probing, server-side reachability checks, and potentially follow-on exploitation depending on deployment environment and accessible internal services. Version 2.58.0 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49865)\n\nAffected packages:\n\n- `kimai/kimai <= 2.57.0`\n\nPatched in:\n\n- `kimai/kimai 2.58.0`\n\nSource: https://github.com/advisories/GHSA-pj8j-p4g4-4vw8","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201712,"id":"CVE-2026-49865","ts":1789399642897,"field":"cvss","old":null,"new":"5.3"},{"seq":200444,"id":"CVE-2026-49865","ts":1789397270204,"field":"cvss","old":"5.3","new":null},{"seq":198069,"id":"CVE-2026-49865","ts":1789384333850,"field":"cvss","old":null,"new":"5.3"},{"seq":196159,"id":"CVE-2026-49865","ts":1789383522533,"field":"cvss","old":"5.3","new":null},{"seq":195088,"id":"CVE-2026-49865","ts":1789380408965,"field":"cvss","old":null,"new":"5.3"},{"seq":193875,"id":"CVE-2026-49865","ts":1789378389803,"field":"cvss","old":"5.3","new":null},{"seq":192662,"id":"CVE-2026-49865","ts":1789376353585,"field":"cvss","old":null,"new":"5.3"},{"seq":191449,"id":"CVE-2026-49865","ts":1789373290618,"field":"cvss","old":"5.3","new":null},{"seq":190234,"id":"CVE-2026-49865","ts":1789369244658,"field":"cvss","old":null,"new":"5.3"},{"seq":189021,"id":"CVE-2026-49865","ts":1789368170434,"field":"cvss","old":"5.3","new":null},{"seq":187804,"id":"CVE-2026-49865","ts":1789365098345,"field":"cvss","old":null,"new":"5.3"},{"seq":186591,"id":"CVE-2026-49865","ts":1789363155200,"field":"cvss","old":"5.3","new":null},{"seq":185377,"id":"CVE-2026-49865","ts":1789361052654,"field":"cvss","old":null,"new":"5.3"},{"seq":184164,"id":"CVE-2026-49865","ts":1789358056581,"field":"cvss","old":"5.3","new":null},{"seq":182415,"id":"CVE-2026-49865","ts":1789354180246,"field":"cvss","old":null,"new":"5.3"},{"seq":181208,"id":"CVE-2026-49865","ts":1789353038711,"field":"cvss","old":"5.3","new":null},{"seq":180001,"id":"CVE-2026-49865","ts":1789350116791,"field":"cvss","old":null,"new":"5.3"},{"seq":178794,"id":"CVE-2026-49865","ts":1789347993625,"field":"cvss","old":"5.3","new":null},{"seq":177587,"id":"CVE-2026-49865","ts":1789346239967,"field":"cvss","old":null,"new":"5.3"},{"seq":176380,"id":"CVE-2026-49865","ts":1789342907945,"field":"cvss","old":"5.3","new":null},{"seq":175834,"id":"CVE-2026-49865","ts":1789338692219,"field":"cvss","old":null,"new":"5.3"},{"seq":175704,"id":"CVE-2026-49865","ts":1789338512086,"field":"cvss","old":"5.3","new":null},{"seq":174499,"id":"CVE-2026-49865","ts":1789334712641,"field":"cvss","old":null,"new":"5.3"},{"seq":173294,"id":"CVE-2026-49865","ts":1789333394247,"field":"cvss","old":"5.3","new":null},{"seq":172108,"id":"CVE-2026-49865","ts":1789330956518,"field":"cvss","old":null,"new":"5.3"},{"seq":170922,"id":"CVE-2026-49865","ts":1789328508115,"field":"cvss","old":"5.3","new":null},{"seq":169717,"id":"CVE-2026-49865","ts":1789327003222,"field":"cvss","old":null,"new":"5.3"},{"seq":168512,"id":"CVE-2026-49865","ts":1789323561966,"field":"cvss","old":"5.3","new":null},{"seq":167307,"id":"CVE-2026-49865","ts":1789319452395,"field":"cvss","old":null,"new":"5.3"},{"seq":166102,"id":"CVE-2026-49865","ts":1789318454979,"field":"cvss","old":"5.3","new":null},{"seq":164897,"id":"CVE-2026-49865","ts":1789315643551,"field":"cvss","old":null,"new":"5.3"},{"seq":163692,"id":"CVE-2026-49865","ts":1789313371812,"field":"cvss","old":"5.3","new":null},{"seq":162487,"id":"CVE-2026-49865","ts":1789311766503,"field":"cvss","old":null,"new":"5.3"},{"seq":161282,"id":"CVE-2026-49865","ts":1789308412784,"field":"cvss","old":"5.3","new":null},{"seq":160787,"id":"CVE-2026-49865","ts":1789304350698,"field":"cvss","old":null,"new":"5.3"},{"seq":160334,"id":"CVE-2026-49865","ts":1789303902597,"field":"cvss","old":"5.3","new":null},{"seq":159395,"id":"CVE-2026-49865","ts":1789300352947,"field":"cvss","old":null,"new":"5.3"},{"seq":158625,"id":"CVE-2026-49865","ts":1789299405608,"field":"cvss","old":"5.3","new":null},{"seq":157589,"id":"CVE-2026-49865","ts":1789296539565,"field":"cvss","old":null,"new":"5.3"},{"seq":156384,"id":"CVE-2026-49865","ts":1789294491777,"field":"cvss","old":"5.3","new":null},{"seq":155179,"id":"CVE-2026-49865","ts":1789292739437,"field":"cvss","old":null,"new":"5.3"},{"seq":153974,"id":"CVE-2026-49865","ts":1789289470675,"field":"cvss","old":"5.3","new":null},{"seq":152624,"id":"CVE-2026-49865","ts":1789281402579,"field":"cvss","old":null,"new":"5.3"},{"seq":152264,"id":"CVE-2026-49865","ts":1789281004474,"field":"cvss","old":"5.3","new":null},{"seq":151225,"id":"CVE-2026-49865","ts":1789277496496,"field":"cvss","old":null,"new":"5.3"},{"seq":150186,"id":"CVE-2026-49865","ts":1789275988072,"field":"cvss","old":"5.3","new":null},{"seq":149153,"id":"CVE-2026-49865","ts":1789273660548,"field":"cvss","old":null,"new":"5.3"},{"seq":148120,"id":"CVE-2026-49865","ts":1789271016338,"field":"cvss","old":"5.3","new":null},{"seq":147030,"id":"CVE-2026-49865","ts":1789269862825,"field":"cvss","old":null,"new":"5.3"},{"seq":145062,"id":"CVE-2026-49865","ts":1789266222394,"field":"cvss","old":"5.3","new":null}]}