Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/67670?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/67670?format=api", "vulnerability_id": "VCID-4a1w-d47t-y3df", "summary": "Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.", "aliases": [ { "alias": "CVE-2026-44298" }, { "alias": "GHSA-h5fh-7hwr-97mw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/375853?format=api", "purl": "pkg:composer/kimai/kimai@2.56.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.56.0" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/926239?format=api", "purl": "pkg:composer/kimai/kimai@2.32.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.32.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926240?format=api", "purl": "pkg:composer/kimai/kimai@2.33.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.33.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926241?format=api", "purl": "pkg:composer/kimai/kimai@2.34.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.34.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926242?format=api", "purl": "pkg:composer/kimai/kimai@2.35.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.35.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926243?format=api", "purl": "pkg:composer/kimai/kimai@2.35.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.35.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/926244?format=api", "purl": "pkg:composer/kimai/kimai@2.36.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.36.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926245?format=api", "purl": "pkg:composer/kimai/kimai@2.36.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.36.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/926246?format=api", "purl": "pkg:composer/kimai/kimai@2.37.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.37.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926247?format=api", "purl": "pkg:composer/kimai/kimai@2.38.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.38.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926248?format=api", "purl": "pkg:composer/kimai/kimai@2.39.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.39.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926249?format=api", "purl": "pkg:composer/kimai/kimai@2.40.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.40.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926250?format=api", "purl": "pkg:composer/kimai/kimai@2.41.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.41.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926251?format=api", "purl": "pkg:composer/kimai/kimai@2.42.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.42.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926252?format=api", "purl": "pkg:composer/kimai/kimai@2.43.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.43.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926253?format=api", "purl": "pkg:composer/kimai/kimai@2.44.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.44.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/926254?format=api", "purl": "pkg:composer/kimai/kimai@2.45.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-vz3c-4twe-ffgv" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.45.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/37913?format=api", "purl": "pkg:composer/kimai/kimai@2.46.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.46.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/957502?format=api", "purl": "pkg:composer/kimai/kimai@2.47.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.47.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/957503?format=api", "purl": "pkg:composer/kimai/kimai@2.48.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.48.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/957504?format=api", "purl": "pkg:composer/kimai/kimai@2.49.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.49.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/40196?format=api", "purl": "pkg:composer/kimai/kimai@2.50.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-8vkc-r8z8-7ugb" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.50.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/40197?format=api", "purl": "pkg:composer/kimai/kimai@2.51.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.51.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/1006486?format=api", "purl": "pkg:composer/kimai/kimai@2.52.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kahk-zqmm-zka9" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-nxtw-3hcs-mydx" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" }, { "vulnerability": "VCID-ys8u-pn7h-ayc7" }, { "vulnerability": "VCID-zfjd-s5wk-eqbz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.52.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/373484?format=api", "purl": "pkg:composer/kimai/kimai@2.53.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-h9gw-dwmf-mfap" }, { "vulnerability": "VCID-kjkh-andk-qqa6" }, { "vulnerability": "VCID-qvcx-4wyw-4uba" }, { "vulnerability": "VCID-we4j-21ku-9yf2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.53.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/373714?format=api", "purl": "pkg:composer/kimai/kimai@2.54.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-kjkh-andk-qqa6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.54.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/1059110?format=api", "purl": "pkg:composer/kimai/kimai@2.55.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1w-d47t-y3df" }, { "vulnerability": "VCID-6as9-19am-2uga" }, { "vulnerability": "VCID-kjkh-andk-qqa6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/kimai/kimai@2.55.0" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44298", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00078", "scoring_system": "epss", "scoring_elements": "0.23278", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00078", "scoring_system": "epss", "scoring_elements": "0.23472", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44298" }, { "reference_url": "https://github.com/kimai/kimai", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/kimai/kimai" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44298", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44298" }, { "reference_url": "https://github.com/kimai/kimai/releases/tag/2.56.0", "reference_id": "2.56.0", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:06:21Z/" } ], "url": "https://github.com/kimai/kimai/releases/tag/2.56.0" }, { "reference_url": "https://github.com/advisories/GHSA-h5fh-7hwr-97mw", "reference_id": "GHSA-h5fh-7hwr-97mw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-h5fh-7hwr-97mw" }, { "reference_url": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw", "reference_id": "GHSA-h5fh-7hwr-97mw", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:06:21Z/" } ], "url": "https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw" } ], "weaknesses": [ { "cwe_id": 22, "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4a1w-d47t-y3df" }