CVE-2026-42267: Kimai formula injection in XLSX export via tag names

CVE-2026-42267 · Severity: medium · CVSS 5.7 · Published 2026-05-08

Kimai, an open-source time-tracking application, is vulnerable to a security flaw where users can inject malicious formulas into spreadsheet exports. By creating a tag with a name starting with an equals sign, a regular user can cause malicious code to execute on an administrator's computer when they export and open the data in Excel. This could lead to unauthorized data manipulation or the compromise of the administrator's workstation.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-42267 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42267 being exploited in the wild.
How severe is CVE-2026-42267?
Medium severity, with a CVSS score of 5.7, published 8 May 2026.
Which products and versions are affected?
Kimai >= 2.27.0, < 2.54.0, >= 2.27.0, <= 2.53.0; kimai/kimai (Packagist) >= 2.27.0, <= 2.53.0, ECOSYSTEM:introduced=2.27.0,fixed=2.54.0.
Is there a fix for CVE-2026-42267?
Yes. kimai/kimai (Packagist): upgrade to 2.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42267 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42267?
Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • kimai/kimai (Packagist): upgrade to 2.54.0 or later
    composer require kimai/kimai:^2.54.0

Technical details

Kimai is vulnerable to CSV/Formula Injection (CWE-1236) via tag names during XLSX export. The vulnerability exists because the `ArrayFormatter::formatValue()` method fails to sanitize tag names using `sanitizeDDE()` before joining them with `implode()`. Additionally, the underlying OpenSpout library automatically promotes strings starting with formula trigger characters (=, +, -, @) to `FormulaCell` types. An attacker with `ROLE_USER` privileges can create a malicious tag via `POST /api/tags` and assign it to a timesheet. When an administrator exports these timesheets to XLSX, the formula is embedded in the file and executed by the spreadsheet software (e.g., Excel or LibreOffice) upon opening. This issue is fixed in version 2.54.0.

Affected products

  • Kimai kimai >= 2.27.0, <= 2.53.0

Identifiers

  • CVE-2026-42267
  • GHSA-3xc2-h5r3-wv3r

Timeline

  • 2026-04-26: disclosed: Initial report to vendor
  • 2026-05-05: advisory: GitHub Advisory published
  • 2026-05-08: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.