https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 09:49:54 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-44298 <p>Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption(&#39;associated_files&#39;, ...) inside the sandboxed Twig render. This is forwarded to mPDF&#39;s SetAssociatedFiles(), whose writer calls file_get_contents($entry[&#39;path&#39;]) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.</p> <p>Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption(&#39;associated_files&#39;, ...) inside the sandboxed Twig render. This is forwarded to mPDF&#39;s SetAssociatedFiles(), whose writer calls file_get_contents($entry[&#39;path&#39;]) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-44298 https://vulnerability.circl.lu/vuln/ghsa-h5fh-7hwr-97mw <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>## Summary</p> <p>Users with the role `System-Admin` (`ROLE_SYSTE_ADMIN`) and the permission `upload_invoice_template` can upload PDF invoice templates, which can call `pdfContext.setOption(&#39;associated_files&#39;, ...)` inside the sandboxed Twig render.</p> <p>This is forwarded to mPDF&#39;s `SetAssociatedFiles()`, whose writer calls `file_get_contents($entry[&#39;path&#39;])` during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice.</p> <p>## Root cause</p> <p>1. `src/Twig/SecurityPolicy/StrictPolicy.php:123-128` explicitly whitelists `PdfContext::setOption()`: ```php if ($obj instanceof PdfContext) { if ($lcm !== &#39;setoption&#39;) { throw ...; } return; } ```</p> <p>2. `src/Pdf/MPdfConverter.php` keeps `associated_files` in the pass-through allowlist: ```php $allowed = [&#39;mode&#39;,&#39;format&#39;,&#39;default_font_size&#39;,&#39;default_font&#39;, ... , &#39;associated_files&#39;,&#39;additional_xmp_rdf&#39;]; ``` and then forwards it to mPDF: ```php if (array_key_exists(&#39;associated_files&#39;, $options) &amp;&amp; is_array($options[&#39;associated_files&#39;])) { $associatedFiles = $options[&#39;associated_files&#39;]; unset($options[&#39;associated_files&#39;]); } ... $mpdf-&gt;SetAssociatedFiles($associatedFiles); ```</p> <p>3. mPDF 8.3.1 `MetadataWriter::writeAssociatedFiles()` calls `file_get_contents`, which respects PHP stream wrappers: ```php if (isset($file[&#39;path&#39;])) { $fileContent = @file_get_contents($file[&#39;…</p> <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>## Summary</p> <p>Users with the role `System-Admin` (`ROLE_SYSTE_ADMIN`) and the permission `upload_invoice_template` can upload PDF invoice templates, which can call `pdfContext.setOption(&#39;associated_files&#39;, ...)` inside the sandboxed Twig render.</p> <p>This is forwarded to mPDF&#39;s `SetAssociatedFiles()`, whose writer calls `file_get_contents($entry[&#39;path&#39;])` during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice.</p> <p>## Root cause</p> <p>1. `src/Twig/SecurityPolicy/StrictPolicy.php:123-128` explicitly whitelists `PdfContext::setOption()`: ```php if ($obj instanceof PdfContext) { if ($lcm !== &#39;setoption&#39;) { throw ...; } return; } ```</p> <p>2. `src/Pdf/MPdfConverter.php` keeps `associated_files` in the pass-through allowlist: ```php $allowed = [&#39;mode&#39;,&#39;format&#39;,&#39;default_font_size&#39;,&#39;default_font&#39;, ... , &#39;associated_files&#39;,&#39;additional_xmp_rdf&#39;]; ``` and then forwards it to mPDF: ```php if (array_key_exists(&#39;associated_files&#39;, $options) &amp;&amp; is_array($options[&#39;associated_files&#39;])) { $associatedFiles = $options[&#39;associated_files&#39;]; unset($options[&#39;associated_files&#39;]); } ... $mpdf-&gt;SetAssociatedFiles($associatedFiles); ```</p> <p>3. mPDF 8.3.1 `MetadataWriter::writeAssociatedFiles()` calls `file_get_contents`, which respects PHP stream wrappers: ```php if (isset($file[&#39;path&#39;])) { $fileContent = @file_get_contents($file[&#39;…</p> https://vulnerability.circl.lu/vuln/ghsa-h5fh-7hwr-97mw