cve/2023/CVE-2023-46245.md

### [CVE-2023-46245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46245)
![](https://img.shields.io/static/v1?label=Product&message=kimai&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.1.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1336%3A%20Improper%20Neutralization%20of%20Special%20Elements%20Used%20in%20a%20Template%20Engine&color=brighgreen)

### Description

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

### POC

#### Reference
- https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcw

#### Github
No PoCs found on GitHub currently.