CVE-2026-80198: Kimai before 2.56.0 Information Disclosure via config() Twig Function
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.56.0 - Configuration
Upgrade to Kimai 2.56.0 or later to ensure the config() Twig function is properly restricted in sandboxed invoice and export templates, preventing access to arbitrary configuration keys.
Kimai (sandboxed invoice/export Twig templates) Twig sandbox restrictions for config() function = Restrict config() Twig function in sandboxed templates
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the disclosed data?
Exploitation requires administrator privileges to upload a malicious invoice or export template. The resulting documents can expose extracted secrets to lower-privileged users who can access those invoices or exports.
What sensitive information could be disclosed?
An administrator can use the unrestricted config() Twig function to retrieve arbitrary configuration keys. The advisory specifically identifies server-wide secrets such as LDAP bind passwords and SAML private keys.
Which deployments are affected?
Kimai versions before 2.56.0 are affected where administrators can upload sandboxed invoice or export templates. The issue is present because config() is not restricted in those template contexts.