Kimai 2.56.0 and earlier versions have an SSRF vulnerability in the invoice PDF preview and generation workflow. When attacker-controlled Markdown content containing image URLs is rendered into PDF, the mPDF renderer fetches these remote images server-side. This enables an attacker with control over invoice Markdown fields to make the Kimai server issue outbound HTTP requests to arbitrary or internal network targets. The vulnerability arises because Markdown images survive the Markdown-to-HTML conversion and are fetched by mPDF during PDF rendering. The issue is not template injection but SSRF caused by the rendering pipeline. The vulnerability is mitigated in Kimai 2.58.0 by disabling Markdown image rendering and using a restricted HTTP client that prevents access to private network addresses.

An attacker able to influence invoice-rendered Markdown fields can cause the Kimai server to make arbitrary outbound HTTP requests. This can be used to probe internal network services, test access to internal administrative endpoints, and confirm server-side reachability to attacker-controlled infrastructure. Depending on deployment, this SSRF could lead to further exploitation such as triggering side effects on internal services or extracting sensitive information accessible only from the server. Since invoice generation is typically performed by administrative or finance users, the vulnerability is realistically exploitable in business workflows.

Kimai 2.58.0 and later versions have mitigations that disable Markdown image rendering by converting them to HTML links instead. Additionally, Kimai uses a specialized HTTP client (`NoPrivateNetworkHttpClient`) for mPDF that blocks requests to private network addresses and other restricted URLs. Users should upgrade to version 2.58.0 or later to apply these fixes. Note that this change may cause backward compatibility issues if invoice or export templates rely on hosting images on the Kimai domain or internal IP addresses. Patch status: An official fix is available in Kimai 2.58.0.