What is CVE-2026-44298?

CVE-2026-44298 is a medium-severity vulnerability in Kimai, classified under Path Traversal. CVSS score: 4.1/10. Published 2026-05-08.

How severe is CVE-2026-44298?

Medium severity. CVSS v3 base score is 4.1 out of 10.

Path Traversal in Kimai

CVE-2026-44298

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can cal…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.001 (21.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N.

Affected products

Kimai — versions >= 2.32.0, < 2.56.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
https://github.com/kimai/kimai/releases/tag/2.56.0 (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-44298?: CVE-2026-44298 is a medium-severity vulnerability in Kimai, classified under Path Traversal. CVSS score: 4.1/10. Published 2026-05-08.
How severe is CVE-2026-44298?: Medium severity. CVSS v3 base score is 4.1 out of 10.