Melnicek

**Name of the Vulnerable Software and Affected Versions** Kimai versions 2.32.0 through 2.55.x **Description** Users with the `System-Admin` role (`ROLE SYSTE ADMIN`) and the `upload invoice template` permission can upload PDF invoice templates that execute `pdfContext.setOption('associated files', ...)` within the sandboxed Twig render. This request is forwarded to the `SetAssociatedFiles()` function of mPDF, which utilizes `file get contents($entry['path'])` during PDF output to embed bytes as a FlateDecode stream. Consequently, any file readable by the PHP worker can be retrieved by an attacker through the rendered invoice. **Recommendations** Update Kimai to version 2.56.0.

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.54.0 **Description** A timing oracle issue exists in the `TokenAuthenticator` component. This allows unauthenticated attackers to perform username enumeration by analyzing response time differences, as the password hasher only executes for users that already exist in the system. This process is facilitated through the `X-AUTH-USER` header and is not mitigated by login throttling protections. **Recommendations** Update to version 2.54.0 or later.