CVE-2026-42267
CVE-2026-42267 · Kimai: Formula Injection via tag names in XLSX export
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened. This issue has been patched in version 2.54.0.
CVSS 5.4 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
kimai
- Versiones
- >= 2.27.0, < 2.54.0: Afectada
Sin corrección publicada
kimai/kimai Packagist
- Versiones
- 2.27.0
- 2.28.0
- 2.29.0
- 2.30.0
- 2.31.0
- 2.32.0
- 2.33.0
- 2.34.0
- 2.35.0
- 2.35.1
- 2.36.0
- 2.36.1
- 2.37.0
- 2.38.0
- 2.39.0
- 2.40.0
- 2.41.0
- 2.42.0
- 2.43.0
- 2.44.0
- 2.45.0
- 2.46.0
- 2.47.0
- 2.48.0
- 2.49.0
- 2.50.0
- 2.51.0
- 2.52.0
- 2.53.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 2.27.0, < 2.54.0
Actualiza a 2.54.0