CVE-2023-46245— Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-46245
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Source: CVE Program / CVE List V5
Vulnerability Description
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5
Vulnerability Title
Kimai 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
kimai是kimai个人开发者的一个基于网络的多用户时间跟踪应用程序。 Kimai 2.1.0 及之前版本存在安全漏洞，该漏洞源于容易受到服务器端模板注入 (SSTI) 攻击，该注入可升级为远程代码执行 (RCE)，当恶意用户上传特制的 Twig 文件并利用该软件的 PDF 和 HTML 渲染功能时，就会出现该漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-46245
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 6541 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-46245
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-46245 (1)
Vendor Advisories for CVE-2023-46245 (1)
- https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcwx_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: kimai
- CVE-2026-44298
Kimai: Arbitrary file read in invoice PDF renderer (admin) - CVE-2026-41498
Kimai: Team API Missing Object-Level Authorization - CVE-2026-42267
Kimai: Formula Injection via tag names in XLSX export - CVE-2026-40486
Kimai's User Preferences API allows standard users to modify - CVE-2026-40479
Kimai: Stored XSS via Incomplete HTML Attribute Escaping in
Same vendor: kimai
- CVE-2026-44298
Kimai: Arbitrary file read in invoice PDF renderer (admin) - CVE-2026-41498
Kimai: Team API Missing Object-Level Authorization - CVE-2026-42267
Kimai: Formula Injection via tag names in XLSX export - CVE-2026-40486
Kimai's User Preferences API allows standard users to modify - CVE-2026-40479
Kimai: Stored XSS via Incomplete HTML Attribute Escaping in
Same weakness: CWE-1336
- CVE-2026-19929
OpenBoxes Template Processing DocumentController.groovy buil - CVE-2026-72827
Grav CMS before 2.0.13 Remote Code Execution via Twig - CVE-2026-13051
Form::Processor::Field::HtmlArea versions from 0.06 through - CVE-2022-4993
HTML::FormHandler versions through 0.40068 for Perl allow at - CVE-2026-73330
CamaleonCMS 2.9.1 Server-Side Template Injection via test_em
V. Comments for CVE-2023-46245
No comments yet