Kimai allows users with ROLE_USER to create tags whose name may include a formula string. When an administrator exports timesheets as an XLSX file, the application writes these tag names directly into the spreadsheet without sanitization, causing OpenSpout to interpret the string as a formula cell. When the file is opened in Excel, the formula is evaluated, potentially revealing internal data or performing unintended calculations. This flaw is indexed as CWE‑1236 and enables formula injection that can lead to information disclosure or execution of arbitrary spreadsheet functions.

All installations of Kimai from version 2.27.0 up to, but not including, 2.54.0 are vulnerable. The affected product is the Kimai time‑tracking application supplied by the vendor kimai:kimai. The specific versions impacted are 2.27.0 through 2.53.9; the issue was fixed in release 2.54.0.

The vulnerability scores a CVSS of 5.4, indicating a moderate severity. No EPSS data is publicly available and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack requires a user to create a malicious tag and an administrator to export timesheets; once the XLSX file is opened by a recipient, Excel will evaluate the injected formula. Because the exploit relies on exporting data and user interaction with the file, the risk is contingent on the environment but still warrants prompt remediation.