Kimai's export feature previously used a permissive Twig sandbox enabling arbitrary method calls on template context objects. An authenticated user with export rights can supply a malicious template that reads environment variables, user password hashes, session tokens, and CSRF tokens, compromising confidentiality.

All Kimai installations running a version earlier than 2.46.0 are affected. The vulnerable product is Kimai, the open‑source time‑tracking application.

The vulnerability has a CVSS score of 6.8 (moderate) and a low EPSS probability (<1%), and it is not listed in the CISA KEV catalog. Exploitation requires a legitimate user account with export permissions; a suitable attacker could then deploy a crafted template and retrieve sensitive data. The attack is limited to the affected user's authorization level, but the data exposed could allow further lateral movement if passwords or session tokens are harvested.