Executive brief
Kimai, an open-source time-tracking application, is vulnerable to a security flaw where users can inject malicious formulas into spreadsheet exports. By creating a tag with a name starting with an equals sign, a regular user can cause malicious code to execute on an administrator's computer when they export and open the data in Excel. This could lead to unauthorized data manipulation or the compromise of the administrator's workstation.
Technical details
Kimai is vulnerable to CSV/Formula Injection (CWE-1236) via tag names during XLSX export. The vulnerability exists because the `ArrayFormatter::formatValue()` method fails to sanitize tag names using `sanitizeDDE()` before joining them with `implode()`. Additionally, the underlying OpenSpout library automatically promotes strings starting with formula trigger characters (=, +, -, @) to `FormulaCell` types. An attacker with `ROLE_USER` privileges can create a malicious tag via `POST /api/tags` and assign it to a timesheet. When an administrator exports these timesheets to XLSX, the formula is embedded in the file and executed by the spreadsheet software (e.g., Excel or LibreOffice) upon opening. This issue is fixed in version 2.54.0.
Affected products
- Kimai kimai >= 2.27.0, <= 2.53.0
Timeline
- 2026-04-26: disclosed: Initial report to vendor
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-08: other: NVD publication date