CVE-2026-49865 in Kimai
Summary
by MITRE • 09/12/2026
Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as `Customer.invoiceText`, the server-side PDF renderer will fetch remote image URLs embedded in Markdown image syntax. This allows the application server to issue outbound requests to attacker-controlled or internal targets during PDF rendering. The behavior can be used for internal network probing, server-side reachability checks, and potentially follow-on exploitation depending on deployment environment and accessible internal services. Version 2.58.0 patches the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
Kimai is a widely deployed open-source time tracking application that facilitates project management and billing through its invoice generation features. In versions prior to 2.58.0, the software contains a critical server-side request forgery vulnerability within its PDF rendering workflow for invoices. This flaw arises from how the application processes Markdown content provided by users, specifically fields such as Customer.invoiceText, which are intended for displaying custom text on generated documents. When an invoice is previewed or generated, the backend system parses this Markdown input and converts it into a PDF file using a server-side rendering engine. The vulnerability stems from the renderer's handling of image syntax within that Markdown content. If the user-supplied Markdown includes standard image tags pointing to remote URLs, the server will automatically attempt to fetch those images during the PDF creation process without validating or sanitizing the destination addresses.
This behavior creates a classic Server-Side Request Forgery scenario where an attacker who can inject controlled Markdown into invoice text fields can force the Kimai application server to make HTTP requests to arbitrary destinations. The impact of this vulnerability is multifaceted, primarily enabling internal network reconnaissance and reachability checks against services that are not directly exposed to the public internet but are accessible from the server's network segment. By embedding malicious image URLs pointing to internal IP addresses or localhost endpoints in the Markdown content, an attacker can determine if specific ports are open, identify running services based on response times or error messages, and map out the internal infrastructure surrounding the Kimai deployment. This capability effectively turns the application into a proxy for probing the local network environment from which it operates.
The operational impact extends beyond mere reconnaissance depending on the broader security context of the hosting environment. If the server has access to sensitive internal APIs, database management interfaces, or other vulnerable services that rely solely on IP-based authentication, this SSRF could potentially be leveraged for further exploitation. For instance, an attacker might attempt to interact with cloud metadata endpoints if the application is hosted in a cloud infrastructure, although the specific description highlights general internal probing and reachability checks as the primary observed use cases. The vulnerability allows for blind or semi-blind data exfiltration scenarios where response content from internal services could theoretically be reflected back through error messages or timing differences during PDF generation, facilitating deeper compromise of the organization's network perimeter defenses which often assume that server-side applications are not direct attack vectors for lateral movement.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving untrusted data influencing web requests to internal resources. It also maps to MITRE ATT&CK techniques related to Discovery and potentially Resource Hijacking if the SSRF is used for cryptomining or other malicious purposes, though in this context it serves primarily as a reconnaissance tool. The root cause lies in the lack of strict URL validation and allow-listing mechanisms within the PDF rendering library or its configuration when processing user-controlled Markdown input. Developers failed to restrict image sources to local paths or verified domains, allowing arbitrary external URLs that trigger outbound connections from the server process itself rather than the client browser.
To mitigate this vulnerability, organizations running Kimai versions prior to 2.58.0 must upgrade immediately to version 2.58.0 or later where the issue has been patched. The patch likely involves implementing strict allow-lists for image URLs during Markdown parsing, ensuring that only trusted domains can be fetched, or disabling remote resource loading entirely within the PDF generation context if not strictly required for business operations. Additionally, network-level mitigations such as egress filtering rules on firewalls and proxy servers should be reviewed to restrict outbound connections from application servers to known internal IP ranges unless explicitly necessary. Implementing web application firewall rules that detect SSRF patterns in HTTP requests originating from the Kimai service can also provide a layer of defense-in-depth against exploitation attempts while patching is being applied.