Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.1 · kimaiNVD modified 2026-10-08 16:16
Affected (CPE criteria) 1
cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*
References 4
- https://github.com/kevinpapst/kimai2 Product
- https://github.com/kevinpapst/kimai2/pull/962 Issue Tracking
- https://www.exploit-db.com/exploits/47286 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss Broken Link