# CVE-2026-42267: Kimai formula injection in XLSX export via tag names

Source: https://junglewise.ai/threats/cve-2026-42267-kimai-formula-injection-in-xlsx-export-via-tag-names  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42267 · Severity: medium · CVSS 5.7 · Published 2026-05-08

Kimai, an open-source time-tracking application, is vulnerable to a security flaw where users can inject malicious formulas into spreadsheet exports. By creating a tag with a name starting with an equals sign, a regular user can cause malicious code to execute on an administrator's computer when they export and open the data in Excel. This could lead to unauthorized data manipulation or the compromise of the administrator's workstation.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42267 being exploited in the wild.

**How severe is CVE-2026-42267?** Medium severity, with a CVSS score of 5.7, published 8 May 2026.

**Which products and versions are affected?** Kimai >= 2.27.0, < 2.54.0, >= 2.27.0, <= 2.53.0; kimai/kimai (Packagist) >= 2.27.0, <= 2.53.0, ECOSYSTEM:introduced=2.27.0,fixed=2.54.0.

**Is there a fix for CVE-2026-42267?** Yes. kimai/kimai (Packagist): upgrade to 2.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42267 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42267?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.54.0 or later

  ```sh
  composer require kimai/kimai:^2.54.0
  ```


## Technical details

Kimai is vulnerable to CSV/Formula Injection (CWE-1236) via tag names during XLSX export. The vulnerability exists because the `ArrayFormatter::formatValue()` method fails to sanitize tag names using `sanitizeDDE()` before joining them with `implode()`. Additionally, the underlying OpenSpout library automatically promotes strings starting with formula trigger characters (=, +, -, @) to `FormulaCell` types. An attacker with `ROLE_USER` privileges can create a malicious tag via `POST /api/tags` and assign it to a timesheet. When an administrator exports these timesheets to XLSX, the formula is embedded in the file and executed by the spreadsheet software (e.g., Excel or LibreOffice) upon opening. This issue is fixed in version 2.54.0.

## Affected products

- Kimai kimai >= 2.27.0, <= 2.53.0

## Identifiers

- CVE-2026-42267
- GHSA-3xc2-h5r3-wv3r

## Timeline

- 2026-04-26: disclosed: Initial report to vendor
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-08: other: NVD publication date

## References

- [https://api.github.com/users/satexd](https://api.github.com/users/satexd)
- [https://github.com/satexd](https://github.com/satexd)
- [https://api.github.com/users/satexd/gists%7B/gist_id%7D](https://api.github.com/users/satexd/gists%7B/gist_id%7D)
- [https://api.github.com/users/satexd/repos](https://api.github.com/users/satexd/repos)
- [https://avatars.githubusercontent.com/u/88040084?v=4](https://avatars.githubusercontent.com/u/88040084?v=4)
- [https://api.github.com/users/satexd/events%7B/privacy%7D](https://api.github.com/users/satexd/events%7B/privacy%7D)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)