How severe is CVE-2026-42267?

CVE-2026-42267 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-42267 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-42267?

CVE-2026-42267 affects Kimai. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-42267?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-42267 have an EU (EUVD) identifier?

Yes. CVE-2026-42267 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-28506.

When was CVE-2026-42267 published?

CVE-2026-42267 was published on 2026-05-08 and last updated on 2026-06-17.

CVE-2026-42267

CVE-2026-42267 is a medium-severity vulnerability in Kimai with a CVSS 3.x base score of 5.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1236.

Key facts

Severity: Medium (CVSS 3.x base score 5.7)
CVSS v4: 5.4
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-28506
Weakness: CWE-1236
Affected product: Kimai
Published: 2026-05-08
Last modified: 2026-06-17

Description

Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened. This issue has been patched in version 2.54.0.

Frequently asked questions

What is CVE-2026-42267?: Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened. This issue has been patched in version 2.54.0.
How severe is CVE-2026-42267?: CVE-2026-42267 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-42267 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-42267?: CVE-2026-42267 affects Kimai. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-42267?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-42267 have an EU (EUVD) identifier?: Yes. CVE-2026-42267 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-28506.
When was CVE-2026-42267 published?: CVE-2026-42267 was published on 2026-05-08 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*

More vulnerabilities in Kimai

CVE-2023-53957 — Critical (CVSS 9.8): Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through…
CVE-2020-19825 — Critical (CVSS 9.6): Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows…
CVE-2021-43515 — High (CVSS 7.8): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling…
CVE-2023-46245 — High (CVSS 7.2): Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side…
CVE-2026-23626 — Medium (CVSS 6.8): Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a…
CVE-2024-29200 — Medium (CVSS 6.8): Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently…

All CVEs affecting Kimai →

Other CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) vulnerabilities

CVE-2026-31049 — Critical (CVSS 9.8): An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate…
CVE-2020-36962 — Critical (CVSS 9.8): Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers…
CVE-2021-47901 — Critical (CVSS 9.8): Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject…
CVE-2020-36941 — Critical (CVSS 9.8): Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV…
CVE-2025-56267 — Critical (CVSS 9.8): A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute…
CVE-2023-47295 — Critical (CVSS 9.8): A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via…

Browse all CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) vulnerabilities →