Kimai versions from 2.32.0 up to but not including 2.56 contain a vulnerability in the invoice PDF renderer that allows users with System-Admin role and upload_invoice_template permission to read arbitrary files accessible to the PHP worker. This occurs because the PDF invoice template feature allows setting 'associated_files' with file paths that are read and embedded into the PDF output. The vulnerability is fixed in version 2.56 by removing the ability to specify file paths for associated files, requiring pre-read content instead.