CVE-2026-44298: its invoice PDF renderer (admin) · Kimai Has an Arbitrary File Read

## Summary Users with the role `System-Admin` (`ROLE_SYSTE_ADMIN`) and the permission `upload_invoice_template` can upload PDF invoice templates, which can call `pdfContext.setOption('associated_files', ...)` inside the sandboxed Twig render. This is forwarded to mPDF's `SetAssociatedFiles()`, whose writer calls `file_get_contents($entry['path'])` during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. ## Root cause 1. `src/Twig/SecurityPolicy/StrictPolicy.php:123-128` explicitly whitelists `PdfContext::setOption()`: ```php if ($obj instanceof PdfContext) { if ($lcm !== 'setoption') { throw ...; } return; } ``` 2. `src/Pdf/MPdfConverter.php` keeps `associated_files` in the pass-through allowlist: ```php $allowed = ['mode','format','default_font_size','default_font', ... , 'associated_files','additional_xmp_rdf']; ``` and then forwards it to mPDF: ```php if (array_key_exists('associated_files', $options) && is_array($options['associated_files'])) { $associatedFiles = $options['associated_files']; unset($options['associated_files']); } ... $mpdf->SetAssociatedFiles($associatedFiles); ``` 3. mPDF 8.3.1 `MetadataWriter::writeAssociatedFiles()` calls `file_get_contents`, which respects PHP stream wrappers: ```php if (isset($file['path'])) { $fileContent = @file_get_contents($file['path']); } ... $filestream = gzcompress($fileContent); $this->writer->write('<</Type /EmbeddedFile'); ``` The sandbox and the option allowlist were both written defensively (short whitelists, not blacklists), but neither side considered that `associated_files` is a PDF/A file-embedding feature whose `path` key is a sink. ## Fix The implemented fix has two aspects: 1. The `PdfContext` now works with a strict allow-list, that excludes `associated_files` 2. The `MPdfConverter` now removes any `path` from the `$associatedFiles` array, which can still be used by plugins: ```php if (\count($associatedFiles) > 0) { // remove "path" so mPDF will not use file_get_contents() on local files // callers must pre-read and pass the bytes via "content" $associatedFiles = array_map(static function ($entry): array { if (!\is_array($entry)) { return []; } if (\array_key_exists('path', $entry)) { unset($entry['path']); } return $entry; }, $associatedFiles); $mpdf->SetAssociatedFiles($associatedFiles); } ```

• github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw (opens in a new tab)
• nvd.nist.gov/vuln/detail/CVE-2026-44298 (opens in a new tab)
• github.com/kimai/kimai (opens in a new tab)
• github.com/kimai/kimai/releases/tag/2.56.0 (opens in a new tab)

• kimai/kimai · Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/exportMediumVulnerability2026-05-06
• kimai/kimai · Kimai has Missing Voter Check that Allows Cross-Team Timesheet ManipulationHighVulnerability2026-05-06
• CVE-2026-49992: Kimai · Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure ChangesMediumVulnerability2026-07-13
• CVE-2026-52819: Kimai · Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the targetMediumVulnerability2026-07-13
• CVE-2026-52820: Kimai · Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypassMediumVulnerability2026-07-13