From version 2.32.0 to just before 2.56.0, Kimai allowed system administrators with the upload_invoice_template permission to upload PDF invoice templates that could invoke the pdfContext sandbox. Through the SetAssociatedFiles call, an attacker could include any file readable by the PHP worker. The resulting PDF delivered the file contents to the admin viewing the invoice, leading to an arbitrary file read that compromises confidentiality. The flaw is a directory traversal/absolute path read weakness (CWE‑22).

Vendor Kimai, product Kimai, affected versions range from 2.32.0 up to but excluding 2.56.0.

The CVSS score of 4.1 rates this as a low‑moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. The attack vector is inferred to be local or internal, requiring an account with System‑Admin privileges and the upload_invoice_template permission. An attacker controlling or compromising such a privileged account could embed arbitrary files into invoice PDFs and retrieve them when viewed by the admin, affecting confidentiality. Because the flaw relies on trusted privileges, the likely likelihood of an attack is low unless privileged credentials are compromised.