p PatchFirst

CVE-2026-42267

CVE-2026-42267 · Kimai: Formula Injection via tag names in XLSX export

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened. This issue has been patched in version 2.54.0.

CVSS 5.4 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • kimai

    Versions
    • >= 2.27.0, < 2.54.0: Affected

    No fix published

  • kimai/kimai Packagist

    Versions
    • 2.27.0
    • 2.28.0
    • 2.29.0
    • 2.30.0
    • 2.31.0
    • 2.32.0
    • 2.33.0
    • 2.34.0
    • 2.35.0
    • 2.35.1
    • 2.36.0
    • 2.36.1
    • 2.37.0
    • 2.38.0
    • 2.39.0
    • 2.40.0
    • 2.41.0
    • 2.42.0
    • 2.43.0
    • 2.44.0
    • 2.45.0
    • 2.46.0
    • 2.47.0
    • 2.48.0
    • 2.49.0
    • 2.50.0
    • 2.51.0
    • 2.52.0
    • 2.53.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.27.0, < 2.54.0

    Update to 2.54.0

Original sources

Check your server →