Kimai 2- persistent cross-site scripting (XSS)

Also known as GHSA-9278-6hcj-2p4j

Published 8 mo ago 2026-02-11 · modified 29 d ago 2026-10-08 · JSON

CVSS

6.4

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 23%

Public exploits

none known

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 8 mo ago 2026-02-11

Exploit prediction (EPSS)

0.30% probability of exploitation in the next 30 days, higher than 23% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	5.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N`
CNA	3.1	6.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`
CNA	4.0	5.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	6.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`
NVD	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
GitHub	3.1	6.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`kimai/kimai`	<1.1	1.1

Affected products

kevinpapst Kimai

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

exploit-db.com /exploits/47286 · exploit
github.com /kevinpapst/kimai2 · product
github.com /kevinpapst/kimai2/pull/962 · issue-tracking
vulncheck.com /advisories/kimai-persistent-cross-site-scripting-xss · third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2019-25317 · advisory
github.com /kimai/kimai/commit/a0e8aa3a435717187fb12210242dab1b7c97ff3f · web
github.com /kimai/kimai · package

Sources

CVE List: CVE-2019-25317
GitHub Advisory: GHSA-9278-6hcj-2p4j
NVD: CVE-2019-25317

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary