Kimai versions between 1.16.3 and 2.52.0 contain a flaw where the escapeForHtml() function fails to escape double and single quote characters. When an authenticated user with standard ROLE_USER privileges sets a malicious profile alias that includes quotes, the alias is rendered inside an HTML attribute via innerHTML, enabling the injected script to execute in the browsers of administrators who view the team member form. The vulnerability allows stored cross‑site scripting with privilege escalation, giving a lower‑privileged user the ability to run arbitrary JavaScript as an administrator.

The affected product is Kimai. All releases from version 1.16.3 through 2.52.0 are vulnerable. The defect was eliminated in version 2.53.0, which correctly escapes quotes in the alias field.

The CVSS score is 5.4, indicating a moderate severity vulnerability. Exploitation requires a logged‑in user with ability to edit their own profile alias, and the script runs in the browser context of any administrator viewing the team form. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. While publicly documented, no active exploits have been reported beyond the advisory. The risk remains for any organization still running the vulnerable range of Kimai releases.